T1495 — Firmware Corruption

Tactic: Impact · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system. Firmware is software that is loaded and executed…

Sigma detection rules (4)

T1495 Firmware Corruption

title: T1495 Firmware Corruption
id: 6ef9bf74-0577-4c83-955d-f543e8f108bf
description: 'Firmware Modification via Flash Tool or Corrupted Firmware Upload, detected as an unsigned kernel driver load whose image path/name references firmware, BIOS, or flash utilities. (Data Component: Driver Load; baseline tier: windows-eventid.) Tune using: ParentImage, CommandLine.'
references:
  - https://attack.mitre.org/techniques/T1495
author: Shahrukh Khan
date: 2026-05-15
license: MIT
tags:
  - attack.impact
  - attack.t1495

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '6'

  selection_unsigned:
    Signed: 'false'

  selection_firmware_related:
    ImageLoaded|contains:
      - 'flash'
      - 'bios'
      - 'firmware'
      - 'efi'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_unsigned and selection_firmware_related and not filter_system_account

falsepositives:
  - Legitimate unsigned OEM/vendor firmware-update utilities (e.g. motherboard BIOS updaters, GPU VBIOS flash tools) installing their own kernel driver during an authorized update window.

level: medium

T1495 Firmware Corruption

title: T1495 Firmware Corruption
id: 2c2c9817-7626-4fca-a0ff-7727270b1613
description: 'Firmware Modification via Flash Tool or Corrupted Firmware Upload. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ToolName.'
references:
  - https://attack.mitre.org/techniques/T1495
author: Shahrukh Khan
date: 2026-06-23
license: MIT
tags:
  - attack.impact
  - attack.t1495

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/flashrom'
      - '/fwupdmgr'
      - '/fwupdate'

  condition: selection

falsepositives:
  - Legitimate firmware update workflows via fwupd during patch cycles; flashrom is rarely present/used outside firmware research or an actual attack, so treat non-fwupd tool usage as high-signal.

level: critical

T1495 Firmware Corruption

title: T1495 Firmware Corruption
id: ec98171b-70dd-4638-afe3-1a3a81816da9
description: 'Firmware Modification via Flash Tool or Corrupted Firmware Upload. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UpdateTimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1495
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.impact
  - attack.t1495

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bless'
      - '/firmwarepasswd'
      - '/eficheck'
  condition: selection

falsepositives:
  - Apple firmware update utilities such as bless and eficheck run legitimately during OS installs and integrity validation, so this should be scoped to executions outside a known softwareupdate or installer session window.

level: critical

T1495 Firmware Corruption

title: T1495 Firmware Corruption
id: a9d9604c-14ee-4f1a-b896-10d0faf85965
description: 'Firmware Modification via Flash Tool or Corrupted Firmware Upload. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: UploadSizeThreshold, RebootWindow.'
references:
  - https://attack.mitre.org/techniques/T1495
author: Shahrukh Khan
date: 2026-06-25
license: MIT
tags:
  - attack.impact
  - attack.t1495

logsource:
  product: nsm
  service: flow

detection:
  selection_upload:
    service:
      - 'ftp'
      - 'ssh'
      - 'http'
  selection_size:
    orig_bytes|gte: 10000000
  selection_mgmt:
    id.resp_p:
      - 22
      - 21
      - 443
      - 80
  condition: all of selection_*

falsepositives:
  - Legitimate large firmware image uploads performed by network administrators during a scheduled maintenance window.

level: high

Explore