T1542.003sub-technique of T1542 Pre-OS Boot
Bootkit
Linux · Windowsnothing on this site yetT1542.003 on attack.mitre.org
Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detection Strategy for File Creation or Modification of Boot Files
- Detection of raw access to physical drives, modification of boot records (MBR/VBR), and suspicious file creation or alteration within the EFI System Partition (ESP). Correlates privileged process execution with low-level disk modification and unexpected driver or firmware interactions.
- Detection of suspicious write operations to block devices, modifications of bootloader files (GRUB, initrd, vmlinuz), and unexpected changes within the EFI System Partition. Monitors privileged execution of utilities like dd, grub-install, or efibootmgr that modify boot sectors or loader entries.
what reduces it
- M1046 Boot Integrity. Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised.
- M1026 Privileged Account Management. Ensure proper permissions are in place to help prevent adversary access to privileged accounts necessary to install a bootkit.