CheckSafeBoot

I used this to see if an EDR is running in Safe Mode

Here is the article https://medium.com/@markmotig/bypass-av-edr-with-safe-mode-975aacecc809?showDomainSetup=true