Technique with 5 sub-techniques.View on attack.mitre.org
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.
Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Rules on DetectionCode tagged with T1542 or one of its sub-techniques.
| Rule | Level | Log source | Technique |
|---|---|---|---|
| UEFI Persistence Via Wpbbin - FileCreation | high | windows / file_event | T1542.001 |
| UEFI Persistence Via Wpbbin - ProcessCreation | high | windows / process_creation | T1542.001 |
| Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE | medium | windows / process_creation | T1542.003 |
| Rule | Type | Risk | Data source | Technique |
|---|---|---|---|---|
| Detect Software Download To Network Device | TTP | NULL | T1542.005 | |
| Linux EFI Bootloader File Deletion | TTP | NULL | Sysmon for Linux EventID 11 | T1542.001 T1542.003 |
| Linux Possible Bootloader Modification | TTP | NULL | Sysmon for Linux EventID 1 | T1542.001 |
| Windows BootLoader Inventory | Hunting | NULL | T1542.001 | |
| Windows EFI Bootloader File Modification | TTP | NULL | Sysmon EventID 11 | T1542.003 |
| Windows EFI Volume Mount Attempt Via Mountvol | Anomaly | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 | T1542 |
| Windows Registry BootExecute Modification | TTP | NULL | Sysmon EventID 13 | T1542 |
| Windows Suspicious File in EFI Volume | TTP | NULL | Sysmon EventID 11 | T1542.001 |
| Windows WinLogon with Public Network Connection | Hunting | NULL | Sysmon EventID 1 AND Sysmon EventID 3 | T1542.003 |
None recorded.
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
