Registry Persistence via Service in Safe Mode (1547e27c-3974-43e2-a7d7-7f484fb928ec)

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d)	Attack Pattern	Registry Persistence via Service in Safe Mode (1547e27c-3974-43e2-a7d7-7f484fb928ec)	Sigma-Rules	1
Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d)	Attack Pattern	Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	2