Firmware Corruption

let FirmwareToolNames = dynamic([
  "rw.exe", "rw64.exe", "rweverything.exe",
  "chipsec.exe", "chipsec_main.exe",
  "flashrom.exe",
  "fpt.exe", "fptw.exe", "fptw64.exe",
  "afuwin.exe", "afuwin64.exe", "afudos.exe",
  "meinfo.exe", "meinfowin.exe", "meinfowin64.exe",
  "amidewin.exe", "amidewin64.exe",
  "h2offt.exe", "h2offt-w.exe",
  "winphlash.exe", "winphlash64.exe",
  "ubuild.exe", "ubu.exe"
]);
let FirmwareWritePatterns = dynamic([
  "--write", "--erase", "--flash",
  "spi write", "spi.write", "spi_write",
  "bios write", "uefi write", "flash write",
  "nvram write", "WRITESPI", "/WRITESPI",
  "chipsec_util spi write",
  "flashrom -w", "flashrom --write"
]);
let SuspiciousParents = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe",
  "wscript.exe", "cscript.exe", "mshta.exe",
  "explorer.exe"
]);
// Signal 1: Execution of known firmware manipulation tools
let FirmwareToolExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (FirmwareToolNames)
| extend Signal = "KnownFirmwareTool"
| extend RiskDetail = strcat("Firmware tool executed: ", FileName);
// Signal 2: Command-line patterns indicating firmware write or erase operations
let FirmwareWriteCmd = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (FirmwareWritePatterns)
| extend Signal = "FirmwareWriteOperation"
| extend RiskDetail = strcat("Write/erase flag in command: ", ProcessCommandLine);
// Signal 3: PowerShell-based UEFI variable modification or BCD tampering
let UEFITamper = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "Set-SecureBootUEFI", "Set-UEFIVariable",
    "bcdedit /set", "bcdedit /delete", "bcdedit /deletevalue"
  )
| extend Signal = "UEFIOrBCDTamper"
| extend RiskDetail = "PowerShell UEFI variable or BCD modification";
// Combine all signals and enrich with context
union FirmwareToolExec, FirmwareWriteCmd, UEFITamper
| extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend IsSystemAccount = AccountName =~ "SYSTEM"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         Signal, RiskDetail, SuspiciousParent, IsSystemAccount
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval ToolHit=if(
    EventCode=1 AND match(Image, "(?i)(\\\\rw\.exe$|\\\\rw64\.exe$|\\\\rweverything\.exe$|\\\\chipsec\.exe$|\\\\chipsec_main\.exe$|\\\\flashrom\.exe$|\\\\fpt\.exe$|\\\\fptw\.exe$|\\\\fptw64\.exe$|\\\\afuwin\.exe$|\\\\afuwin64\.exe$|\\\\afudos\.exe$|\\\\meinfo\.exe$|\\\\amidewin\.exe$|\\\\h2offt\.exe$|\\\\winphlash\.exe$|\\\\winphlash64\.exe$)"),
    1, 0
  )
| eval WritePatternHit=if(
    EventCode=1 AND match(CommandLine, "(?i)(--write|--erase|--flash|-W\s|-E\s|spi[._]write|bios.write|uefi.write|flash.write|nvram.write|WRITESPI|flashrom\s+-w\b|chipsec_util.spi.write)"),
    1, 0
  )
| eval DriverLoadHit=if(
    EventCode=6 AND match(ImageLoaded, "(?i)(\\\\rw\.sys$|\\\\rwdrv\.sys$|\\\\winio\.sys$|\\\\winio32\.sys$|\\\\winio64\.sys$|\\\\physmem\.sys$|\\\\pmem\.sys$|\\\\dbutil_2_3\.sys$|\\\\rtcore64\.sys$)"),
    1, 0
  )
| eval UEFITamper=if(
    EventCode=1 AND (match(Image, "(?i)\\\\(powershell|pwsh)\.exe$")) AND match(CommandLine, "(?i)(Set-SecureBootUEFI|Set-UEFIVariable|bcdedit.*/set|bcdedit.*/delete)"),
    1, 0
  )
| eval RiskScore=ToolHit + WritePatternHit + (DriverLoadHit * 2) + UEFITamper
| where RiskScore > 0
| eval Signal=case(
    DriverLoadHit=1, "SuspiciousFirmwareDriver",
    WritePatternHit=1 AND ToolHit=1, "FirmwareToolWithWriteOp",
    ToolHit=1, "KnownFirmwareTool",
    UEFITamper=1, "UEFIOrBCDTamper",
    WritePatternHit=1, "FirmwareWritePattern",
    true(), "UnknownFirmwareSignal"
  )
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, ImageLoaded, EventCode, Signal, RiskScore
| sort - RiskScore, - _time

sequence by host.id with maxspan=5m
  [process where event.type == "start" and (
    process.name : ("rw.exe", "rw64.exe", "rweverything.exe", "chipsec.exe", "chipsec_main.exe", "flashrom.exe", "fpt.exe", "fptw.exe", "fptw64.exe", "afuwin.exe", "afuwin64.exe", "afudos.exe", "meinfo.exe", "meinfowin.exe", "meinfowin64.exe", "amidewin.exe", "amidewin64.exe", "h2offt.exe", "h2offt-w.exe", "winphlash.exe", "winphlash64.exe", "ubuild.exe", "ubu.exe") or
    process.args : ("--write", "--erase", "--flash", "spi write", "spi.write", "spi_write", "bios write", "uefi write", "flash write", "nvram write", "WRITESPI", "/WRITESPI", "chipsec_util spi write", "flashrom -w", "flashrom --write") or
    (process.name : ("powershell.exe", "pwsh.exe") and process.args : ("Set-SecureBootUEFI", "Set-UEFIVariable", "bcdedit") and process.args : ("/set", "/delete", "/deletevalue"))
  )]
  [any where event.category == "driver" and
    file.name : ("rw.sys", "rwdrv.sys", "winio.sys", "winio32.sys", "winio64.sys", "physmem.sys", "pmem.sys", "dbutil_2_3.sys", "rtcore64.sys")
  ]

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourceid,
  LOGSOURCENAME(logsourceid) AS log_source,
  sourceip,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "ParentProcessName" AS parent_process,
  CASE
    WHEN LOWER("Process Name") MATCHES '.*\\(rw\.exe|rw64\.exe|rweverything\.exe|chipsec\.exe|chipsec_main\.exe|flashrom\.exe|fpt\.exe|fptw\.exe|fptw64\.exe|afuwin\.exe|afuwin64\.exe|afudos\.exe|meinfo\.exe|meinfowin\.exe|meinfowin64\.exe|amidewin\.exe|amidewin64\.exe|h2offt\.exe|h2offt-w\.exe|winphlash\.exe|winphlash64\.exe|ubuild\.exe|ubu\.exe)$' THEN 'KnownFirmwareTool'
    WHEN LOWER("Command") MATCHES '.*(--write|--erase|--flash|spi[._]write|bios.write|uefi.write|flash.write|nvram.write|writespi|flashrom\s+-w|chipsec_util.spi.write).*' THEN 'FirmwareWriteOperation'
    WHEN LOWER("Process Name") MATCHES '.*(powershell|pwsh)\.exe$' AND LOWER("Command") MATCHES '.*(set-securebootuefi|set-uefivariable|bcdedit.*/set|bcdedit.*/delete).*' THEN 'UEFIOrBCDTamper'
    WHEN LOWER("Filename") MATCHES '.*\\(rw\.sys|rwdrv\.sys|winio\.sys|winio32\.sys|winio64\.sys|physmem\.sys|pmem\.sys|dbutil_2_3\.sys|rtcore64\.sys)$' THEN 'SuspiciousFirmwareDriver'
    ELSE 'UnknownFirmwareSignal'
  END AS signal
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 14, 15)
  AND starttime > NOW() - 24 HOURS
  AND (
    LOWER("Process Name") MATCHES '.*\\(rw\.exe|rw64\.exe|rweverything\.exe|chipsec\.exe|chipsec_main\.exe|flashrom\.exe|fpt\.exe|fptw\.exe|fptw64\.exe|afuwin\.exe|afuwin64\.exe|afudos\.exe|meinfo\.exe|h2offt\.exe|winphlash\.exe|ubuild\.exe|ubu\.exe)$'
    OR LOWER("Command") MATCHES '.*(--write|--erase|--flash|spi[._]write|bios.write|uefi.write|flash.write|nvram.write|writespi|flashrom\s+-w).*'
    OR (LOWER("Process Name") MATCHES '.*(powershell|pwsh)\.exe$' AND LOWER("Command") MATCHES '.*(set-securebootuefi|set-uefivariable|bcdedit).*')
    OR LOWER("Filename") MATCHES '.*\\(rw\.sys|rwdrv\.sys|winio\.sys|winio32\.sys|winio64\.sys|physmem\.sys|pmem\.sys|dbutil_2_3\.sys|rtcore64\.sys)$'
  )
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| parse field=Message "Image: *" as process_image nodrop
| parse field=Message "CommandLine: *" as command_line nodrop
| parse field=Message "ImageLoaded: *" as image_loaded nodrop
| parse field=Message "ParentImage: *" as parent_image nodrop
| parse field=Message "User: *" as username nodrop
| parse field=Message "Computer: *" as hostname nodrop
| parse field=Message "EventID: *" as event_id nodrop
| where event_id in ("1", "6", "7")
| eval tool_hit = if(matches(toLowerCase(process_image), ".*(\\\\rw\.exe|\\\\rw64\.exe|\\\\rweverything\.exe|\\\\chipsec\.exe|\\\\chipsec_main\.exe|\\\\flashrom\.exe|\\\\fpt\.exe|\\\\fptw\.exe|\\\\fptw64\.exe|\\\\afuwin\.exe|\\\\afuwin64\.exe|\\\\afudos\.exe|\\\\meinfo\.exe|\\\\amidewin\.exe|\\\\h2offt\.exe|\\\\winphlash\.exe|\\\\ubuild\.exe|\\\\ubu\.exe)$"), 1, 0)
| eval write_hit = if(matches(toLowerCase(command_line), ".*(--write|--erase|--flash|spi[._]write|bios.write|uefi.write|flash.write|nvram.write|writespi|flashrom\\s+-w|chipsec_util.spi.write).*"), 1, 0)
| eval driver_hit = if(matches(toLowerCase(image_loaded), ".*(\\\\rw\.sys|\\\\rwdrv\.sys|\\\\winio\.sys|\\\\winio32\.sys|\\\\winio64\.sys|\\\\physmem\.sys|\\\\pmem\.sys|\\\\dbutil_2_3\.sys|\\\\rtcore64\.sys)$"), 1, 0)
| eval uefi_hit = if(matches(toLowerCase(process_image), ".*(powershell|pwsh)\.exe$") and matches(toLowerCase(command_line), ".*(set-securebootuefi|set-uefivariable|bcdedit.*/set|bcdedit.*/delete).*"), 1, 0)
| eval risk_score = tool_hit + write_hit + (driver_hit * 2) + uefi_hit
| where risk_score > 0
| eval signal = if(driver_hit == 1, "SuspiciousFirmwareDriver",
    if(write_hit == 1 and tool_hit == 1, "FirmwareToolWithWriteOp",
    if(tool_hit == 1, "KnownFirmwareTool",
    if(uefi_hit == 1, "UEFIOrBCDTamper",
    if(write_hit == 1, "FirmwareWritePattern", "UnknownFirmwareSignal")))))
| fields _messagetime, hostname, username, process_image, command_line, parent_image, image_loaded, event_id, signal, risk_score
| sort by risk_score desc, _messagetime desc

rule t1495_firmware_corruption {
  meta:
    author = "Detection Engineering"
    description = "Detects T1495 Firmware Corruption via known firmware tools, write/erase operations, suspicious driver loads, and UEFI/BCD tampering"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1495"
    severity = "CRITICAL"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-13"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e.principal.process.file.full_path, `(?i)\\(rw\.exe|rw64\.exe|rweverything\.exe|chipsec\.exe|chipsec_main\.exe|flashrom\.exe|fpt\.exe|fptw\.exe|fptw64\.exe|afuwin\.exe|afuwin64\.exe|afudos\.exe|meinfo\.exe|meinfowin\.exe|meinfowin64\.exe|amidewin\.exe|amidewin64\.exe|h2offt\.exe|h2offt-w\.exe|winphlash\.exe|winphlash64\.exe|ubuild\.exe|ubu\.exe)$`)
        or re.regex($e.target.process.command_line, `(?i)(--write|--erase|--flash|spi[._]write|bios.write|uefi.write|flash.write|nvram.write|WRITESPI|flashrom\s+-w|chipsec_util.spi.write)`)
        or (
          re.regex($e.principal.process.file.full_path, `(?i)\\(powershell|pwsh)\.exe$`)
          and re.regex($e.target.process.command_line, `(?i)(Set-SecureBootUEFI|Set-UEFIVariable|bcdedit.*/set|bcdedit.*/delete|bcdedit.*/deletevalue)`)
        )
      )
    )
    or
    (
      $e.metadata.event_type = "DRIVER_LOAD"
      and re.regex($e.target.file.full_path, `(?i)\\(rw\.sys|rwdrv\.sys|winio\.sys|winio32\.sys|winio64\.sys|physmem\.sys|pmem\.sys|dbutil_2_3\.sys|rtcore64\.sys)$`)
    )

  condition:
    $e
}

// T1495 - Firmware Corruption Detection
// Signal 1: Known firmware tool execution
#event_simpleName = ProcessRollup2
| FileName = /(?i)(rw\.exe|rw64\.exe|rweverything\.exe|chipsec\.exe|chipsec_main\.exe|flashrom\.exe|fpt\.exe|fptw\.exe|fptw64\.exe|afuwin\.exe|afuwin64\.exe|afudos\.exe|meinfo\.exe|meinfowin\.exe|meinfowin64\.exe|amidewin\.exe|amidewin64\.exe|h2offt\.exe|h2offt-w\.exe|winphlash\.exe|winphlash64\.exe|ubuild\.exe|ubu\.exe)$/
| eval Signal = "KnownFirmwareTool"
| eval RiskScore = 3

// Signal 2: Firmware write/erase command-line patterns
| union [
    #event_simpleName = ProcessRollup2
    | CommandLine = /(?i)(--write|--erase|--flash|spi[._]write|bios[. ]write|uefi[. ]write|flash[. ]write|nvram[. ]write|WRITESPI|\/WRITESPI|flashrom\s+-w|chipsec_util.spi.write)/
    | eval Signal = "FirmwareWriteOperation"
    | eval RiskScore = 3
  ]

// Signal 3: PowerShell UEFI or BCD tampering
| union [
    #event_simpleName = ProcessRollup2
    | FileName = /(?i)(powershell|pwsh)\.exe$/
    | CommandLine = /(?i)(Set-SecureBootUEFI|Set-UEFIVariable|bcdedit.*\/set|bcdedit.*\/delete|bcdedit.*\/deletevalue)/
    | eval Signal = "UEFIOrBCDTamper"
    | eval RiskScore = 4
  ]

// Signal 4: Suspicious firmware kernel driver load
| union [
    #event_simpleName = DriverLoad
    | ImageFileName = /(?i)(rw\.sys|rwdrv\.sys|winio\.sys|winio32\.sys|winio64\.sys|physmem\.sys|pmem\.sys|dbutil_2_3\.sys|rtcore64\.sys)$/
    | eval Signal = "SuspiciousFirmwareDriver"
    | eval RiskScore = 5
  ]

| groupBy([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, Signal], function=[
    max(RiskScore, as=MaxRiskScore),
    count(as=EventCount),
    min(timestamp, as=FirstSeen),
    max(timestamp, as=LastSeen)
  ])
| eval SuspiciousParent = if(ParentBaseFileName = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|explorer\.exe)/, "true", "false")
| sort(MaxRiskScore, order=desc)
| select([LastSeen, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, Signal, MaxRiskScore, EventCount, SuspiciousParent])