Ransomware Identifying Ransomware’s Stealthy Boot Configuration Edits

[MuzzMelbourne]

The research by Binary Defense entails the various threat hunting techniques and detections for a regularly reported Ransomware-as-a-Service (RaaS) methodology. Using the built-in Windows programme bcdedit.exe (Boot Configuration Data Edit), threat actors have been spotted changing boot loader configurations to:

• Modify Boot Status Policies
• Disable Recovery Mode
• Enable Safe Mode

Identifying Ransomware’s Stealthy Boot Configuration Edits

Threat actors have been spotted changing boot loader configurations, read on to know more.

www.cysecurity.news

 

[DDE_Server]

Excellent Article thanks for sharing