T1542.001 — System Firmware

Tactics: Stealth, Persistence · Platforms: Network Devices, Windows

Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and…

Sub-technique of Pre-OS Boot (T1542).

Sigma detection rules (2)

T1542.001 Pre-OS Boot: System Firmware

title: "T1542.001 Pre-OS Boot: System Firmware"
id: b4fd9b54-11e6-44fb-9e41-ca030e076b8f
description: 'Detects loading of low-level hardware/SPI-flash access drivers (e.g. RWEverything, WinRing0) that are commonly abused to read or write system firmware (BIOS/UEFI) directly, bypassing OS-level protections -- a Windows-observable proxy for T1542.001 Pre-OS Boot: System Firmware, since the firmware write itself is not visible in Sysmon/Security telemetry. Tune using: AllowedFirmwareUpdateTools, TimeWindow, KnownGoodFirmwareHashes.'
references:
  - https://attack.mitre.org/techniques/T1542/001
author: Shahrukh Khan
date: 2026-05-07
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.001

logsource:
  category: driver_load
  product: windows
  service: sysmon

detection:
  selection:
    ImageLoaded|endswith:
      - '\RwDrv.sys'
      - '\WinRing0x64.sys'
      - '\WinRing0.sys'
      - '\AsrDrv103.sys'
      - '\GLCKIo.sys'

  condition: selection

falsepositives:
  - Legitimate hardware-monitoring/overclocking utilities (e.g. MSI Afterburner, ASUS AI Suite, CPU-Z) load some of the same low-level access drivers; tune with a signed/known-vendor allowlist if noise remains.

level: high

T1542.001 Pre-OS Boot: System Firmware

title: "T1542.001 Pre-OS Boot: System Firmware"
id: eafe42ba-bac2-496d-9ab0-3a5a70c1bcab
description: 'Detection Strategy for T1542.001 Pre-OS Boot: System Firmware. (Data Component: Firmware Modification; baseline tier: fallback.) Tune using: ApprovedFirmwareHashes, MaintenanceWindows, SourceIPWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1542/001
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.001

logsource:
  product: networkdevice
  service: config

detection:
  selection_bootloader:
    Message|contains:
      - 'boot system flash'
      - 'boot loader'
      - 'set chassis boot'
  selection_source:
    Message|contains:
      - 'tftp'
      - 'scp'
      - 'ftp'
  condition: selection_bootloader and selection_source

falsepositives:
  - Approved bootloader update pulled from an authorized internal file server during scheduled maintenance.

level: high

Related sub-techniques

Explore