T1542.004 — ROMMONkit

Tactics: Stealth, Persistence · Platforms: Network Devices

Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to…

Sub-technique of Pre-OS Boot (T1542).

Sigma detection rules (1)

T1542.004 Pre-OS Boot: ROMMONkit

title: "T1542.004 Pre-OS Boot: ROMMONkit"
id: b3139795-7828-4b61-bf92-c6c9475e6e96
description: 'Detection Strategy for T1542.004 Pre-OS Boot: ROMMONkit. (Data Component: Firmware Modification; baseline tier: fallback.) Tune using: ApprovedROMMONVersions, TimeWindow, AdminUserContext.'
references:
  - https://attack.mitre.org/techniques/T1542/004
author: Shahrukh Khan
date: 2026-03-04
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.004

logsource:
  product: networkdevice
  service: config

detection:
  selection_rommon:
    Message|contains:
      - 'rommon'
      - 'ROMMON'
      - 'boot loader upgrade'
  selection_config_register:
    Message|contains: 'config-register'
  condition: 1 of selection_*

falsepositives:
  - Vendor-directed bootloader upgrade performed by an administrator as part of an approved firmware refresh.

level: high

Related sub-techniques

Explore