MITRE ATT&CKsub-technique

T1542.001 System Firmware

Published 2019-12-19 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Persistence
Platforms
Network Devices, Windows
Version
2.0
Created
2019-12-19

Description

Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1542 Pre-OS Boot technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1046 Boot Integrity mitigation
  • M1051 Update Software mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (3)

  • S0397 LoJax software (malware)
  • S0001 Trojan.Mebromi software (malware)
  • S0047 Hacking Team UEFI Rootkit software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-532 Altered Installed BIOS attack pattern

Referenced by Compliance · mitigates (19)

  • CIS-7.3 Perform Automated Operating System Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SC-34 Non-modifiable Executable Programs NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References