analyzing-uefi-bootkit-persistence

name	analyzing-uefi-bootkit-persistence
description	Use when analyzing UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing.
domain	cybersecurity
tags	["UEFI","bootkit","firmware","Secure-Boot","chipsec","ESP","persistence"]
subdomain	firmware-security
version	1.0.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Platform Hardening","Restore Object","Platform Monitoring","Firmware Verification","Firmware Embedded Monitoring Code"]
nist_csf	["ID.RA-01","PR.PS-01","PR.PS-02"]

Analyzing Uefi Bootkit Persistence

Overview

Cybersecurity skill for analyzing uefi bootkit persistence. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing uefi bootkit persistence"

• "Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI "

• A compromised system re-establishes C2 communication after OS reinstallation or disk replacement

• Secure Boot has been tampered with, disabled, or shows unexpected Machine Owner Key (MOK) enrollment

• Firmware integrity verification fails against vendor-provided baselines

• Memory forensics reveals rootkit components loading during early boot phase

• Investigating advanced persistent threat (APT) campaigns known to deploy UEFI implants

• Auditing firmware security posture for enterprise endpoint hardening

Do not use for standard MBR-based bootkits on legacy BIOS systems without UEFI; use MBR/VBR bootkit analysis instead.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• chipsec framework for SPI flash dumping, UEFI variable inspection, and firmware security modules
• UEFITool / UEFIExtract for firmware volume parsing and DXE driver extraction
• Python 3.8+ with struct, hashlib, subprocess, and os modules
• Bootable Linux live USB for offline analysis (avoid running compromised OS)
• Volatility 3 for memory forensics of boot-phase artifacts
• YARA with UEFI malware rule sets for pattern-based detection
• Access to vendor firmware baselines for integrity comparison

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}