CyberStack

MITRE ATT&CK / Techniques / T1542

Pre-OS Boot

ID
T1542
Tactics
TA0003 Persistence, TA0005 Stealth
Platforms
Linux, macOS, Network Devices, Windows
Data sources
Process Creation, File Creation, Drive Access, File Modification, Command Execution, Firmware Modification, Drive Modification
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.[3]

Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Sub-techniques (5)

Detection

Mitigations (5)

M1026 Privileged Account Management

Ensure proper permissions are in place to help prevent adversary access to privileged accounts necessary to perform these actions

M1035 Limit Access to Resource Over Network

Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.

M1046 Boot Integrity

Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. [1] [2]

M1047 Audit

Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.

M1051 Update Software

Patch the BIOS and EFI as necessary.

References

  1. TCG Trusted Platform Module
  2. TechNet Secure Boot Process
  3. Wikipedia Booting