MITRE ATT&CKsub-technique
T1693.001 System Firmware
- Domain
- ics
- Tactics
- Persistence, Inhibit Response Function, Impair Process Control
- Platforms
- Embedded, Windows, Linux, Network Devices
- Version
- 1.0
- Created
- 2026-04-20
Description
System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network.
An adversary may exploit the firmware update feature on accessible devices to upload malicious or out-of-date firmware. Malicious modification of device firmware may provide an adversary with root access to a device, given firmware is one of the lowest programming abstraction layers.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1693 Modify Firmware technique
Tactic · MITRE ATT&CK (3)
Referenced by MITRE ATT&CK · mitigates (13)
- M0801 Access Management mitigation
- M0802 Communication Authenticity mitigation
- M0804 Human User Authentication mitigation
- M0808 Encrypt Network Traffic mitigation
- M0937 Filter Network Traffic mitigation
- M0941 Encrypt Sensitive Information mitigation
- M0945 Code Signing mitigation
- M0946 Boot Integrity mitigation
- M0947 Audit mitigation
- M0951 Update Software mitigation
- M0807 Network Allowlists mitigation
- M0930 Network Segmentation mitigation
- M0813 Software Process and Device Authentication mitigation
References
- http://www.sciencedirect.com/science/article/pii/S1874548213000231 Basnight, Zachry, et al.