Techniques › T1542
T1542 Pre-OS Boot
stealth · persistence — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1542
0
KEV CVEs mapped here
<p>Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.</p><p>Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0278 Detection Strategy for T1542 Pre-OS Boot v1.0
AN0774 WindowsUnusual modification of boot records (MBR, VBR) or EFI partitions not associated with legitimate patch cycles or OS upgrades. Registry or WMI events associated with firmware update tools executed from unexpected parent processes. API calls (e.g., DeviceIoControl) writing directly to raw disk sectors. Subsequent abnormal boot configuration changes followed by unsigned driver loads.Tunable:
AllowedFirmwareUpdateToolsTimeWindowEntropyThresholdAN0775 LinuxDetection of writes to /boot or EFI directories outside of expected package manager updates. Monitoring kernel log and auditd events for attempts to overwrite bootloader binaries (e.g., grub, shim). Unexpected execution of efibootmgr or dd writing to /dev/sdX devices followed by boot parameter changes.auditd:EXECVEexec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions→ DC0064 Command ExecutionTunable:PackageManagerUpdateWhitelistFilesystemPathsAN0776 macOSAbnormal modification of EFI firmware binaries in /System/Library/CoreServices/ or NVRAM parameters not associated with OS updates. Unified logs capturing calls to bless or nvram commands executed from untrusted parent processes. Sudden unsigned kext loads after EFI variable tampering.Tunable:AllowedBootUtilitiesBootParamBaselineAN0777 Network DevicesUnexpected firmware image uploads via TFTP/FTP/SCP. Configuration changes modifying boot image pointers. Logs showing boot variable redirection to non-standard images. Anomalous reboots immediately following firmware changes not tied to patch schedules.networkdevice:configBoot variable modified to point to non-standard or unsigned image→ DC0004 Firmware Modificationnetworkdevice:firmwareUnexpected firmware image upload events via TFTP/FTP/SCP→ DC0046 Drive ModificationTunable:ApprovedFirmwareHashesMaintenanceWindows
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1542
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.