EmbargoS1247 ↗
Has used a DLL variant of MDeployer to disable security solutions through Safe Mode.1
tfMITRE ATT&CK technique
Safe Mode Boot T1688
- Tactic
- Defense Impairment
- Platform
- Windows
- Version
- 1.0
- Created
- 14 April 2026
- Last modified
- 12 May 2026
- Contributors
- Jorell Magtibay, National Australia Bank Limited; Kiyohito Yamamoto, RedLark, NTT Communications; Yusuke Kubo, RedLark, NTT Communications
Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.7
Tools & malware71st pct
Tools & malware71st percentile · 69% of ATT&CK techniques have fewer tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.