MITRE ATT&CKtechnique

T1495 Firmware Corruption

Published 2019-04-12 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Impact
Platforms
Linux, macOS, Network Devices, Windows
Version
1.3
Created
2019-04-12

Description

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system. Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards. In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable. Depending on the device, this attack may also result in Data Destruction.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1046 Boot Integrity mitigation
  • M1051 Update Software mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (3)

  • C0063 2025 Poland Wiper Attacks campaign
  • S0606 Bad Rabbit software (malware)
  • S0266 TrickBot software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-532 Altered Installed BIOS attack pattern

Referenced by Compliance · mitigates (18)

  • CIS-7.3 Perform Automated Operating System Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References