| name | T1542.001_system-firmware |
| description | Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are exa... |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1542.001","persistence","defense-evasion","windows","network-devices","sub-technique"] |
| technique_id | T1542.001 |
| tactic | persistence |
| all_tactics | ["persistence","defense-evasion"] |
| platforms | ["Windows","Network Devices"] |
| mitre_url | https://attack.mitre.org/techniques/T1542/001 |
| tech_stack | ["windows","network devices"] |
| cwe_ids | ["CWE-276"] |
| chains_with | ["T1542","T1542.002","T1542.003","T1542.004","T1542.005"] |
| prerequisites | ["T1542"] |
| severity_boost | {"T1542":"Chain with T1542 for deeper attack path","T1542.002":"Chain with T1542.002 for deeper attack path","T1542.003":"Chain with T1542.003 for deeper attack path"} |
T1542.001 System Firmware
Sub-technique of: T1542
High-Level Description
Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.
System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Kill Chain Phase
- Persistence (TA0003)
- Defense Evasion (TA0005)
Platforms: Windows, Network Devices
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: UEFI Persistence via Wpbbin.exe File Creation
Creates Wpbbin.exe in %systemroot%. This technique can be used for UEFI-based pre-OS boot persistence mechanisms.
Supported Platforms: windows
Yes
