Detect Firmware Corruption in IBM QRadar
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system. Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards. Real-world examples include TrickBot's 'Trickboot' module (2020), which can write or erase UEFI/BIOS firmware of a compromised device, and Bad Rabbit ransomware, which installed a modified bootloader to prevent normal boot-up. Firmware corruption often results in permanent hardware denial-of-availability and may be combined with data destruction for maximum impact.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1495 Firmware Corruption
- Canonical reference
- https://attack.mitre.org/techniques/T1495/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourceid,
LOGSOURCENAME(logsourceid) AS log_source,
sourceip,
username,
"Process Name" AS process_name,
"Command" AS command_line,
"ParentProcessName" AS parent_process,
CASE
WHEN LOWER("Process Name") MATCHES '.*\\(rw\.exe|rw64\.exe|rweverything\.exe|chipsec\.exe|chipsec_main\.exe|flashrom\.exe|fpt\.exe|fptw\.exe|fptw64\.exe|afuwin\.exe|afuwin64\.exe|afudos\.exe|meinfo\.exe|meinfowin\.exe|meinfowin64\.exe|amidewin\.exe|amidewin64\.exe|h2offt\.exe|h2offt-w\.exe|winphlash\.exe|winphlash64\.exe|ubuild\.exe|ubu\.exe)$' THEN 'KnownFirmwareTool'
WHEN LOWER("Command") MATCHES '.*(--write|--erase|--flash|spi[._]write|bios.write|uefi.write|flash.write|nvram.write|writespi|flashrom\s+-w|chipsec_util.spi.write).*' THEN 'FirmwareWriteOperation'
WHEN LOWER("Process Name") MATCHES '.*(powershell|pwsh)\.exe$' AND LOWER("Command") MATCHES '.*(set-securebootuefi|set-uefivariable|bcdedit.*/set|bcdedit.*/delete).*' THEN 'UEFIOrBCDTamper'
WHEN LOWER("Filename") MATCHES '.*\\(rw\.sys|rwdrv\.sys|winio\.sys|winio32\.sys|winio64\.sys|physmem\.sys|pmem\.sys|dbutil_2_3\.sys|rtcore64\.sys)$' THEN 'SuspiciousFirmwareDriver'
ELSE 'UnknownFirmwareSignal'
END AS signal
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 13, 14, 15)
AND starttime > NOW() - 24 HOURS
AND (
LOWER("Process Name") MATCHES '.*\\(rw\.exe|rw64\.exe|rweverything\.exe|chipsec\.exe|chipsec_main\.exe|flashrom\.exe|fpt\.exe|fptw\.exe|fptw64\.exe|afuwin\.exe|afuwin64\.exe|afudos\.exe|meinfo\.exe|h2offt\.exe|winphlash\.exe|ubuild\.exe|ubu\.exe)$'
OR LOWER("Command") MATCHES '.*(--write|--erase|--flash|spi[._]write|bios.write|uefi.write|flash.write|nvram.write|writespi|flashrom\s+-w).*'
OR (LOWER("Process Name") MATCHES '.*(powershell|pwsh)\.exe$' AND LOWER("Command") MATCHES '.*(set-securebootuefi|set-uefivariable|bcdedit).*')
OR LOWER("Filename") MATCHES '.*\\(rw\.sys|rwdrv\.sys|winio\.sys|winio32\.sys|winio64\.sys|physmem\.sys|pmem\.sys|dbutil_2_3\.sys|rtcore64\.sys)$'
)
ORDER BY starttime DESC
LIMIT 500QRadar AQL query detecting T1495 firmware corruption attempts across Windows Sysmon and Security event log sources. Identifies known firmware tools, write/erase command patterns, UEFI/BCD tampering via PowerShell, and suspicious firmware-related kernel driver loads. Signals are classified by type and ranked by severity.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled BIOS/UEFI firmware updates deployed by endpoint management tools such as SCCM, Intune, or vendor-specific utilities that execute fpt.exe or h2offt.exe as child processes
- Chipsec or RWEverything used by internal hardware validation teams performing pre-deployment firmware audits on new endpoint models
- bcdedit commands executed legitimately by Windows Update, BitLocker configuration scripts, or IT provisioning automation during imaging workflows
Other platforms for T1495
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CHIPSEC UEFI Variable Enumeration — Read-Only Firmware Reconnaissance
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'chipsec_util.py uefi var-list'. Sysmon Event ID 6: Driver load for chipsec.sys (or chipsec_hlpr.sys) from a temp or install directory. Security Event ID 7045: New service installed for the CHIPSEC kernel driver. Windows may prompt for UAC on driver installation.
- Test 2RW-Everything Hardware Access Tool Execution with Ring-0 Driver Load
Expected signal: Sysmon Event ID 1: Process Create with Image=Rw.exe and CommandLine containing '/Command="PCI 0 0 0 0 10"'. Sysmon Event ID 6: Driver load for rw.sys from tool directory or System32\drivers\. Security Event ID 7045: New service named 'RW' registered pointing to rw.sys. Service exits after tool completes but driver load telemetry persists.
- Test 3PowerShell BCD Store Modification — Bad Rabbit Bootloader Tamper Simulation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'bcdedit /set' and ExecutionPolicy Bypass. Two additional Sysmon EventCode=1 events for bcdedit.exe child processes. Security Event ID 4688 (if command-line auditing enabled) for both bcdedit invocations. PowerShell ScriptBlock Log Event ID 4104 capturing the full command.
- Test 4Linux flashrom SPI Flash Probe — Non-Destructive Hardware Reconnaissance
Expected signal: Linux auditd EXECVE record with a=flashrom, argv containing '-p', 'internal', '--no-action', '-V'. Syslog entry capturing sudo invocation and flashrom execution. On systems with Sysmon for Linux (EventID 1): Process Create event for flashrom. /var/log/auth.log entry recording sudo authentication for the flashrom command.
- Test 5Intel Flash Programming Tool (FPT) Flash Descriptor Read
Expected signal: Sysmon Event ID 1: Process Create with Image=fptw64.exe, CommandLine containing '-DESC -d'. Sysmon Event ID 11: File Create event for df00tech_flashdesc.bin in %TEMP%. Security Event ID 7045 may appear if FPT installs a kernel service for hardware access. The .bin file size will reflect the flash descriptor region size (typically 4KB).
References (8)
- https://attack.mitre.org/techniques/T1495/
- https://securelist.com/bad-rabbit-ransomware/82851/
- https://eclypsium.com/research/trickbot-now-offers-trickboot-persist-brick-profit/
- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
- https://cyber.dhs.gov/assets/report/ar-16-20173.pdf
- https://chipsec.github.io/
- https://www.flashrom.org/
- https://web.archive.org/web/20190508170055/https://www.symantec.com/security-center/writeup/2000-122010-2655-99
Unlock Pro Content
Get the full detection package for T1495 including response playbook, investigation guide, and atomic red team tests.