Cross-source coverage

T1542 / ATT&CK

Pre-OS Boot

22 rules across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.

Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Tactics
Stealth · Persistence
Platforms
Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:EXECVEmacos:unifiedlognetworkdevice:confignetworkdevice:firmware

How MITRE says to detect it DET0278

Detection Strategy for T1542 Pre-OS Boot

Windows Analytic 0774

Unusual modification of boot records (MBR, VBR) or EFI partitions not associated with legitimate patch cycles or OS upgrades. Registry or WMI events associated with firmware update tools executed from unexpected parent processes. API calls (e.g., DeviceIoControl) writing directly to raw disk sectors. Subsequent abnormal boot configuration changes followed by unsigned driver loads.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=9

Linux Analytic 0775

Detection of writes to /boot or EFI directories outside of expected package manager updates. Monitoring kernel log and auditd events for attempts to overwrite bootloader binaries (e.g., grub, shim). Unexpected execution of efibootmgr or dd writing to /dev/sdX devices followed by boot parameter changes.

  • auditd:SYSCALL open, write: Modification of /boot/grub/* or /boot/efi/*
  • auditd:EXECVE exec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions

macOS Analytic 0776

Abnormal modification of EFI firmware binaries in /System/Library/CoreServices/ or NVRAM parameters not associated with OS updates. Unified logs capturing calls to bless or nvram commands executed from untrusted parent processes. Sudden unsigned kext loads after EFI variable tampering.

  • macos:unifiedlog Execution of bless or nvram modifying boot parameters
  • macos:unifiedlog Modification of /System/Library/CoreServices/boot.efi

Network Devices Analytic 0777

Unexpected firmware image uploads via TFTP/FTP/SCP. Configuration changes modifying boot image pointers. Logs showing boot variable redirection to non-standard images. Anomalous reboots immediately following firmware changes not tied to patch schedules.

  • networkdevice:config Boot variable modified to point to non-standard or unsigned image
  • networkdevice:firmware Unexpected firmware image upload events via TFTP/FTP/SCP

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 22 above — a rule tagged a sub-technique covers this technique too.

splunk/security_content

9 rules
Detection Severity Format
Detect Software Download To Network Device Undefined SPL
Linux EFI Bootloader File Deletion Undefined SPL
Linux Possible Bootloader Modification Undefined SPL
Windows BootLoader Inventory Undefined SPL
Windows EFI Bootloader File Modification Undefined SPL
Windows EFI Volume Mount Attempt Via Mountvol Undefined SPL
Windows Registry BootExecute Modification Undefined SPL
Windows Suspicious File in EFI Volume Undefined SPL
Windows WinLogon with Public Network Connection Undefined SPL

elastic/detection-rules

7 rules
Detection Severity Format
Boot File Copy Low Elastic TOML
Dracut Module Creation Low Elastic TOML
GRUB Configuration File Creation Low Elastic TOML
GRUB Configuration Generation through Built-in Utilities Low Elastic TOML
Initramfs Extraction via CPIO Low Elastic TOML
Initramfs Unpacking via unmkinitramfs Low Elastic TOML
Manual Dracut Execution Low Elastic TOML

SigmaHQ/sigma

3 rules
Detection Severity Format
UEFI Persistence Via Wpbbin - FileCreation High Sigma
UEFI Persistence Via Wpbbin - ProcessCreation High Sigma
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE Medium Sigma

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Zoom room high CPU alerts Undefined KQL

elastic/protections-artifacts

1 rule
Detection Severity Format
Persistence via Extensible Firmware Modification Undefined Elastic TOML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
MITRE ATTaCK T1542.001 Pre-OS Boot: System Firmware - wpbbin.exe file created in System32. Possible firmware persistence attempt. High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.