Pre-OS Boot: System Firmware
- ID
- T1542.001
- Tactics
- TA0003 Persistence, TA0005 Stealth
- Sub-technique of
- T1542 Pre-OS Boot
- Platforms
- Network Devices, Windows
- Data sources
- Process Creation, Drive Access, File Creation, Firmware Modification, Drive Modification
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.[4][5][6]
System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Detection
- DET0099 Detection Strategy for T1542.001 Pre-OS Boot: System Firmware
Data components: Process Creation, Drive Access, File Creation, Firmware Modification, Drive Modification
Mitigations (3)
- M1026 Privileged Account Management
Prevent adversary access to privileged accounts or access necessary to perform this technique.
- M1046 Boot Integrity
Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology. [1] Move system's root of trust to hardware to prevent tampering with the SPI flash memory.[2] Technologies such as Intel Boot Guard can assist with this. [3]
- M1051 Update Software
Patch the BIOS and EFI as necessary.
Software (3)
References
- TCG Trusted Platform Module
- ESET LoJax Sept 2018
- Intel Hardware-based Security Technologies
- Wikipedia BIOS
- Wikipedia UEFI
- About UEFI