Adversaries may abuse Windows safe mode to disable endpoint defenses.

Tactics
TA0005

Sub-technique of
T1562


See: MITRE ATT&CK