Question Analysis

// BCDEdit modifying recovery settings investigation // Look for executions of bcdedit that modify recovery settings (recoveryenabled, recoverysequence, displaybootmenu, bootstatuspolicy) let keywords = dynamic(["recoveryenabled","recoverysequence","displaybootmenu","bootstatuspolicy","/set","/delete","/set {","/enum"]); // Search process events where commandline or file name mentions bcdedit let proc = DeviceProcessEvents | where isnotempty(ProcessCommandLine) or isnotempty(ProcessVersionInfoOriginalFileName) or isnotempty(FileName) | extend pcl = tolower(ProcessCommandLine), fname = tolower(ProcessVersionInfoOriginalFileName), file = tolower(FileName) | where pcl contains "bcdedit" or fname contains "bcdedit" or file contains "bcdedit" | extend Source = "DeviceProcessEvents", Cmd = coalesce(ProcessCommandLine, ""), Executable = coalesce(ProcessVersionInfoOriginalFileName, FileName) | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain = InitiatingProcessAccountDomain, AccountSid = InitiatingProcessAccountSid, ProcessId, Executable, Cmd, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime, Source; // Search device events (other events) that may include bcdedit invocations let dev = DeviceEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) or isnotempty(FileName) | extend pcl = tolower(ProcessCommandLine), ipl = tolower(InitiatingProcessCommandLine), file = tolower(FileName) | where pcl contains "bcdedit" or ipl contains "bcdedit" or file contains "bcdedit" | extend Source = "DeviceEvents", Cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, ""), Executable = FileName | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain = InitiatingProcessAccountDomain, AccountSid, ProcessId = InitiatingProcessId, Executable, Cmd, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime = InitiatingProcessCreationTime, Source; proc | union dev | where isnotempty(Cmd) | extend cmd_lower = tolower(Cmd) // keep events that contain any of the keywords (recovery settings or set/delete operations) | where array_length(keywords) == array_length(keywords) or cmd_lower has_any (keywords) // attempt to extract the bcdedit argument portion by finding 'bcdedit' and returning the rest of the command | extend idx = indexof(cmd_lower, "bcdedit") | extend cmd_after = iff(idx >= 0, trim(' ', substring(Cmd, idx + strlen("bcdedit"))), Cmd) | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain, AccountSid, Source, ProcessId, Executable, Command = cmd_after, RawCommand = Cmd, ProcessCreationTime | order by TimeGenerated desc | take 200