Safe Mode Boot
Technique · ATTACK:enterprise:T1688
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1688",
"title": "Safe Mode Boot",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1688",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--c7660f19-f8c5-4ae3-a5e5-24381c270376",
"external_id": "T1688",
"domain": "enterprise",
"created": "2026-04-14T22:53:27.979Z",
"modified": "2026-05-12T15:12:00.716Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"defense-impairment"
],
"source_references": [
{
"source_name": "BleepingComputer REvil 2021",
"url": "https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/"
},
{
"source_name": "Sophos Safe Mode Boot",
"url": "https://www.sophos.com/en-us/blog/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection"
},
{
"source_name": "Cybereason safe mode boot",
"url": "https://www.cybereason.com/blog/research/medusalocker-ransomware"
},
{
"source_name": "Microsoft Windows Startup Settings",
"url": "https://support.microsoft.com/en-us/windows/windows-startup-settings-1af6ec8c-4d4a-4b23-adb7-e76eef0b847f"
},
{
"source_name": "Microsoft bcdedit",
"url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit"
},
{
"source_name": "CyberArk Labs Safe Mode 2016",
"url": "https://www.cyberark.com/resources/blog/cyberark-labs-from-safe-mode-to-domain-compromise"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07969240-a4ee-44e7-a9ee-b3386c6222cd
CyberArk Labs Safe Mode 2016ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23c9b72a-ae73-4d2d-a127-34c33ae0311d
ESET Embargo Ransomware October 2024ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b089236-9b2f-40ee-9230-6961de8a60be
Costa AvosLocker May 2022 · Trend Micro AvosLocker Apr 2022ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50484fcd-8b37-4a95-9705-49006ba0edd5
CyberArk Labs Safe Mode 2016ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac61af37-72e0-410f-96a9-453519a20747
BleepingComputer REvil 2021ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bce6eb76-c438-41b0-8dca-6a2d29844abd
Avertium Black Basta June 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · Minerva Labs Black Basta May 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6c69c31-f292-4939-82e2-addbd84604e9
Trend Micro Agenda Ransomware AUG 2022 · BushidoToken Qilin RaaS JUN 2024ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e683db23-0a9e-408f-8197-7d88c52f360a
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee04cde4-5567-4e30-b316-ead0c20e3f86
Group-IB RansomHub FEB 2025