MITRE D3FENDdefensive technique

D3-FV Firmware Verification

Official page ↗

Tactic: Detect

Definition

Cryptographically verifying firmware integrity.

How it works

How it works Cryptographic hash values are computed for system and peripheral firmware. The hash values are compared against precomputed hash values for the identified firmware. A hash value mismatch may indicate that the firmware may have been tampered with or updated with a non-current release indicating a misconfiguration for the system. Considerations • Requires cryptographically computed hash values of firmware • Requires storage of precomputed firmware hash values

Counters · MITRE ATT&CK (6)

T1542.004 ROMMONkit sub-technique
T0851 Rootkit technique
T1542.001 System Firmware sub-technique
T1542.002 Component Firmware sub-technique
T1542 Pre-OS Boot technique
T1014 Rootkit technique

Child of · MITRE D3FEND (1)

D3-PM Platform Monitoring defensive technique

Referenced by MITRE D3FEND · child of (2)

D3-PFV Peripheral Firmware Verification defensive technique
D3-SFV System Firmware Verification defensive technique

References

https://patents.google.com/patent/US20200074086A1/en Methods and systems for hardware and firmware security monitoring
https://patents.google.com/patent/US9674183B2/en System and method for hardware-based trust control management
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-193.pdf Platform Firmware Resiliency Guidelines