UEFI / system-firmware implant
Malicious BIOS/UEFI module that survives OS reinstall
categoryMalwareseverityHighdetectabilityLowlabnot yet measured
Example: LoJax, CosmicStrand
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1542.001 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1542.001 -TestGuids b8a49f03-e3c4-40f2-b7bb-9e8f8fdddbf1 -TimeoutSeconds 120'Queued for lab measurement — not yet detonated.
Classification
31 values: 13 reviewed, 14 imported, 4 derived. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | High |
| Privileges required | High |
| User interaction | None |
| Attacker skill required | High |
| Resources required | High |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Platform | Network DevicesWindows |
| Environment | On-premises |
| Target asset class | EndpointPhysicalServer |
| Kill-chain phase (tactic) | PersistenceStealth |
Detection & telemetry
| Detectability | Low |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Drive AccessDrive ModificationFile CreationFirmware ModificationProcess Creation |
| Defense bypassed | Anti-virusFile monitoringHost intrusion prevention |
Detection & response
Mitigated by 11
- M1026 attack-mitigation
- M1046 attack-mitigation
- M1051 attack-mitigation
D3-AVEd3fendD3-FBAd3fendD3-FEMCd3fendD3-FVd3fendD3-RSd3fendD3-SFVd3fendD3-SUd3fendD3-SWId3fend
Detected by 3
- DET0099 attack-detection-strategy
4abc0ec4-db5a-412f-9632-26659cddf145sigmae94b9ddc-eec5-4bb8-8a58-b9dc5f4e185fsigma
Tested by 1
b8a49f03-e3c4-40f2-b7bb-9e8f8fdddbf1atomic
Framework references
- Primary source: https://attack.mitre.org/techniques/T1542/001/
- attack: T1542.001 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 83 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)