I used this to see if an EDR is running in Safe Mode - View it on GitHub