T1542.003 — Bootkit

Tactics: Stealth, Persistence · Platforms: Linux, Windows

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to…

Sub-technique of Pre-OS Boot (T1542).

Sigma detection rules (2)

T1542.003 Pre-OS Boot: Bootkit

title: "T1542.003 Pre-OS Boot: Bootkit"
id: de1af8c6-dac0-4a03-a8a7-91d12f2e7c7e
description: 'Detects raw disk/volume access (Sysmon RawAccessRead) to physical drives or volumes by processes outside the expected set of backup, disk-management, or security tooling, consistent with reading or overwriting the Master Boot Record/Volume Boot Record for bootkit installation per T1542.003. (Data Component: Drive Access; baseline tier: windows-eventid.) Tune using: KnownGoodMBRHashes, ESPFileWhitelist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1542/003
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.003

logsource:
  category: raw_access_thread
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '9'
    Device|contains:
      - '\PhysicalDrive'
      - '\HarddiskVolume'
  filter_known_tools:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbengine.exe'
      - '\backup.exe'
      - '\defrag.exe'
      - '\chkdsk.exe'
      - '\MsMpEng.exe'
  condition: selection and not filter_known_tools

falsepositives:
  - Legitimate backup, disk-imaging, defragmentation, or antivirus scanning software performing raw disk/volume reads.

level: medium

T1542.003 Pre-OS Boot: Bootkit

title: "T1542.003 Pre-OS Boot: Bootkit"
id: a23e1082-79dc-41f0-9be0-296fe7ac9ab9
description: 'Detection Strategy for File Creation or Modification of Boot Files. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Now requires nametype CREATE/DELETE (an actual file creation, replacement, or removal) or a write-oriented syscall (creat, unlink, unlinkat, rename, renameat, renameat2) against the boot paths, instead of nametype NORMAL alone which only confirms the path was referenced/read by tools like grub-mkconfig, os-prober, or update-grub. Tune using: EFIFileAllowlist, AlertThresholds.'
references:
  - https://attack.mitre.org/techniques/T1542/003
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.003

logsource:
  category: file_change
  product: linux

detection:
  selection_path_create_delete:
    type: PATH
    nametype:
      - CREATE
      - DELETE
    name|contains:
      - '/boot/efi/'
      - '/boot/grub/'
  selection_write_syscall:
    type: SYSCALL
    syscall:
      - creat
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
    success: 'yes'
    name|contains:
      - '/boot/efi/'
      - '/boot/grub/'
  condition: selection_path_create_delete or selection_write_syscall

falsepositives:
  - Legitimate bootloader/kernel updates during OS patching (grub-install, update-grub, kernel/initramfs regeneration) legitimately create, delete, and rename files under /boot/efi/ and /boot/grub/; a genuine BootloaderHashBaseline comparison against known-good file hashes still requires an external file-integrity-monitoring tool, since raw auditd PATH/SYSCALL events carry no content hash.

level: critical

Related sub-techniques

Explore