Detect Bcedit Commands Related To Boot Configuration
Query
DeviceProcessEvents
| where ProcessCommandLine startswith "bcdedit"About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1490 | Inhibit System Recovery |
Author: Sergio Albea (02/07/2025)
Detect bcedit commands related to boot configuration
This KQL query is designed to detect adversaries attempt to modify the boot configuration using bcdedit commands. Such changes are often used to disable recovery options or suppress error messages after encryption, helping ransomware persist stealthily across reboot.
Explanation
This KQL query is used to identify potential malicious activity by detecting the use of the "bcdedit" command, which is related to modifying boot configuration settings on a device. The query specifically looks for any process events where the command line starts with "bcdedit". This is important because attackers might use this command to disable system recovery options or hide error messages, which can help ransomware remain undetected and persist after a system reboot.
