Firmware rootkit (CosmicStrand)
Modified DXE driver hooks the boot chain to load a kernel implant
categoryCryptographic, hardware and side-channel attacksseverityHighdetectabilityLowlabnot yet measured
Example: Gigabyte/ASUS boards
Classification
29 values: 17 imported, 1 derived, 11 machine-classified. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | High |
| Privileges required | High |
| User interaction | None |
| Attacker skill required | High |
| Resources required | High |
| Likelihood / prevalence | Low |
| Maturity | Emerging |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | Network DevicesWindows |
| Environment | On-premises |
| Target asset class | EndpointSupply chain |
| Kill-chain phase (tactic) | PersistenceStealth |
Detection & telemetry
| Detectability | Low |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Drive AccessDrive ModificationFile CreationFirmware ModificationProcess Creation |
| Defense bypassed | Anti-virusFile monitoringHost intrusion prevention |
Detection & response
Mitigated by 11
- M1026 attack-mitigation
- M1046 attack-mitigation
- M1051 attack-mitigation
D3-AVEd3fendD3-FBAd3fendD3-FEMCd3fendD3-FVd3fendD3-RSd3fendD3-SFVd3fendD3-SUd3fendD3-SWId3fend
Detected by 3
- DET0099 attack-detection-strategy
4abc0ec4-db5a-412f-9632-26659cddf145sigmae94b9ddc-eec5-4bb8-8a58-b9dc5f4e185fsigma
Tested by 1
b8a49f03-e3c4-40f2-b7bb-9e8f8fdddbf1atomic
Framework references
- Primary source: https://securelist.com/cosmicstrand-uefi-firmware-rootkit/106973/
- attack: T1542.001 (primary)
- capec: CAPEC-532
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cryptographic, hardware and side-channel attacks' table, line 591 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1542.001, capec:CAPEC-532 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (CAPEC — Common Attack Pattern Enumeration and Classification 3.9) — CAPEC-532 Altered Installed BIOS: CAPEC prerequisites for this pattern
Advanced knowledge about the installed target system design. | Advanced knowledge about the download and update installation processes. | Access to the download and update system(s) used to deliver BIOS images.
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)