Cross-source coverage

T1495 / ATT&CK

Firmware Corruption

2 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system. Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.

In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable. Depending on the device, this attack may also result in Data Destruction.

Tactics
Impact
Platforms
Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:Microsoft-Windows-Kernel-Bootauditd:SYSCALLmacos:unifiedlogNSM:Flownetworkdevice:firmware

How MITRE says to detect it DET0167

Firmware Modification via Flash Tool or Corrupted Firmware Upload

Windows Analytic 0474

Firmware flash utility invoked with elevated privileges followed by raw access to firmware device path or changes to boot configuration.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=6
  • WinEventLog:Microsoft-Windows-Kernel-Boot Firmware integrity validation failed or boot configuration tampered

Linux Analytic 0475

Direct write access to /dev/mem or /sys/firmware combined with usage of firmware flashing utilities (e.g., flashrom).

  • auditd:SYSCALL write access to /dev/mem or /sys/firmware/efi/efivars
  • auditd:SYSCALL execution of known flash tools (e.g., flashrom, fwupd)

macOS Analytic 0476

EFI updates executed via system processes or binaries outside of expected patch windows or using unsigned firmware packages.

  • macos:unifiedlog com.apple.firmwareupdater activity or update-firmware binary invoked
  • macos:unifiedlog boot failure events or SMC validation errors

Network Devices Analytic 0477

Firmware image uploaded via TFTP/SCP or web interface followed by reboot or unexpected loss of connectivity.

  • NSM:Flow large upload to firmware interface port or path
  • networkdevice:firmware Firmware update initiated or bootloader tampering detected

View on attack.mitre.org ↗

SigmaHQ/sigma

1 rule
Detection Severity Format
Cisco Denial of Service Medium Sigma

elastic/protections-artifacts

1 rule
Detection Severity Format
Persistence via Extensible Firmware Modification Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.