T1542.003 Bootkit

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. In…

MITRE ATT&CK page ↗

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.