Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Medusa – Reboot into Safe Mode Followed by Security Service Stop

Medusa Defense Evasion Sentinel
MITRE ATT&CK
Service Stop
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
CISA/FBI #StopRansomware: Medusa advisory; ransomware.live group_tools dataset (medusa)
What This Detects
Medusa affiliates force a reboot into Safe Mode (where most EDR agents don't load) and then explicitly stop any surviving AV/EDR services before encrypting. Correlates bcdedit safeboot with a net/sc stop of a security-product service.
Query
let safeMode = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("safeboot minimal","safeboot network")
| project DeviceName, SafeModeTime = Timestamp;
let svcStop = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("net.exe","net1.exe","sc.exe")
| where ProcessCommandLine has_any ("stop","config")
| where ProcessCommandLine has_any ("WinDefend","Sense","MBAMService","Sophos","Cortex","SepMasterService")
| project DeviceName, StopTime = Timestamp, StopCmd = ProcessCommandLine;
safeMode
| join kind=inner svcStop on DeviceName
| where StopTime - SafeModeTime between (0min .. 2h)
| project DeviceName, SafeModeTime, StopTime, StopCmd

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.