T1542 Pre-OS Boot
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- UEFI Persistence Via Wpbbin - FileCreationhightest · windows
- UEFI Persistence Via Wpbbin - ProcessCreationhightest · windows
- Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXEmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.