T1542.002 — Component Firmware

Tactics: Stealth, Persistence · Platforms: Windows, Linux, macOS

Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be…

Sub-technique of Pre-OS Boot (T1542).

Sigma detection rules (3)

T1542.002 Pre-OS Boot: Component Firmware

title: "T1542.002 Pre-OS Boot: Component Firmware"
id: cd452b46-c2d6-4eb0-bea9-58f982ec741a
description: 'Detection Strategy for T1542.002 Pre-OS Boot: Component Firmware. (Data Component: Driver Load; baseline tier: windows-eventid.) Tune using: KnownGoodFirmwareHashes, DriverAllowList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1542/002
author: Shahrukh Khan
date: 2026-05-29
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.002

logsource:
  category: driver_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '6'

  filter_signed:
    Signed: 'true'

  condition: selection and not filter_signed

falsepositives:
  - Legitimately signed but unrecognized/newly-issued vendor drivers will still match since only signature presence is checked, not a specific allowlist; tune further with KnownGoodFirmwareHashes/DriverAllowList for recurring unsigned drivers already vetted in your environment.

level: medium

T1542.002 Pre-OS Boot: Component Firmware

title: "T1542.002 Pre-OS Boot: Component Firmware"
id: 6e1a458c-9d0d-4e5f-addf-d5df80aff483
description: 'Detection Strategy for T1542.002 Pre-OS Boot: Component Firmware, now scoped to write/flash actions (flashrom -w, fwupdate --apply, fwupdmgr update/install) instead of any invocation of these tools, so read-only firmware dumps (e.g. flashrom -r) no longer alert; severity lowered from critical to high to match confirmed-write-without-baseline-comparison confidence. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FirmwareImageBaseline, AlertThresholds.'
references:
  - https://attack.mitre.org/techniques/T1542/002
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_flashrom_write:
    type: EXECVE
    a0|endswith: '/flashrom'
    a1|contains: '-w'
  selection_fwupdate_apply:
    type: EXECVE
    a0|endswith: '/fwupdate'
    a1|contains: 'apply'
  selection_fwupdmgr_write:
    type: EXECVE
    a0|endswith: '/fwupdmgr'
    a1:
      - 'update'
      - 'install'
  condition: 1 of selection_*

falsepositives:
  - Legitimate firmware update tooling used by IT during patch cycles; FirmwareImageBaseline hash comparison against a known-good image is not something process telemetry can perform and needs an external integrity tool.

level: high

T1542.002 Pre-OS Boot: Component Firmware

title: "T1542.002 Pre-OS Boot: Component Firmware"
id: a16efab7-932f-4aae-8142-f8b3b2866211
description: 'Detection Strategy for T1542.002 Pre-OS Boot: Component Firmware. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ApprovedKextList, EFIHashBaseline.'
references:
  - https://attack.mitre.org/techniques/T1542/002
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/eficheck'
      - '/firmwarepasswd'
  condition: selection

falsepositives:
  - EFI hash baseline comparisons and firmware password checks are surfaced by eficheck and firmwarepasswd but genuine EFI hash mismatches from unauthorized kext or component firmware writes cannot be reliably distinguished from a legitimate Apple firmware update from process telemetry alone; treat any eficheck anomaly report as requiring manual hash validation.

level: critical

Related sub-techniques

Explore