CheckSafeBoot I used this to see if an EDR is running in Safe Mode Here is the article https://medium.com/@markmotig/bypass-av-edr-with-safe-mode-975aacecc809?showDomainSetup=true