Detect System Firmware in Google Chronicle
Adversaries may modify system firmware (BIOS or UEFI/EFI) to achieve persistent access that survives OS reinstallation and disk replacement. Because firmware executes before the operating system loads, malicious implants planted here are extremely difficult to detect and remove. Attackers typically require a vulnerable or attacker-supplied kernel-mode driver to gain ring-0 access to SPI flash memory before overwriting or patching the firmware image. Real-world examples include LoJax (Fancy Bear/APT28), which repurposed the legitimate LoJack anti-theft agent's UEFI module; Trojan.Mebromi, which modified the Award BIOS; and the Hacking Team UEFI Rootkit. Detection must focus on observable pre-conditions and side-effects: execution of firmware analysis and flashing utilities, loading of privileged hardware-access drivers, suspicious UEFI variable modification, and creation of raw firmware image files.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.001 System Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/001/
YARA-L Detection Query
rule t1542_001_system_firmware {
meta:
author = "df00tech"
description = "Detects T1542.001 System Firmware: firmware analysis/flashing tools, privileged hardware-access kernel drivers enabling SPI flash write, and raw firmware image creation indicative of UEFI/BIOS implant staging"
mitre_attack_technique = "T1542.001"
mitre_attack_tactic = "Persistence, Defense Evasion"
severity = "CRITICAL"
version = "1.0"
events:
(
$e.metadata.event_type = "PROCESS_LAUNCH" and
(
$e.principal.process.file.full_path = /(?i)(chipsec\.exe|flashrom\.exe|RWEverything\.exe|RwDrv\.exe|AFUWIN64?\.exe|fptw?64?\.exe|FWUpdate\.exe|biosflash\.exe|meinfo\.exe|UEFITool\.exe|iflash\.exe|AmiBIOSCoreUtil\.exe)/ nocase
or $e.principal.process.command_line = /(?i)(chipsec|flashrom|SpiFlash|bios\.rom|uefi\.rom|bios\.bin|bios_backup|flash_bios|RWEverything|writephysmem|readphysmem)/ nocase
)
)
or
(
$e.metadata.event_type = "PROCESS_MODULE_LOAD" and
$e.target.file.full_path = /(?i)(RwDrv\.sys|sednit\.sys|chipsec\.sys|WinIo64?\.sys|PhyMemX64\.sys|DirectIO64\.sys|asmmap64\.sys|gdrv\.sys|bsflash64\.sys|inpoutx64\.sys|hwrwdrv\.sys|lenovoemc\.sys|atkwio\.sys)/ nocase
)
or
(
$e.metadata.event_type = "FILE_CREATION" and
(
$e.target.file.full_path = /(?i)\.(rom|fd|cap)$/ nocase
or (
$e.target.file.full_path = /(?i)\.bin$/ nocase and
not $e.target.file.full_path = /(?i)(\\Windows\\|\\Program Files\\)/ nocase and
not $e.principal.process.file.full_path = /(?i)(svchost\.exe|MsMpEng\.exe|TrustedInstaller\.exe)/ nocase
)
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule for T1542.001 System Firmware using UDM event model. Covers three detection branches: PROCESS_LAUNCH events matching known firmware analysis and flashing tool filenames or command-line patterns indicative of BIOS/UEFI access; PROCESS_MODULE_LOAD events for named privileged kernel drivers (RwDrv, WinIo, CHIPSEC, gdrv, DirectIO) required to gain ring-0 SPI flash write capability; and FILE_CREATION events for raw firmware image extensions (.rom, .fd, .cap) or .bin files outside system paths not created by trusted system processes. Maps to MITRE ATT&CK T1542.001 under Persistence and Defense Evasion.
Data Sources
Required Tables
False Positives & Tuning
- OEM firmware update utilities triggered by Windows Update or vendor management agents (Dell SupportAssist, HP Support Solutions) that load signed flashing tools and write .cap or .bin update packages to user-accessible staging directories
- Authorized hardware penetration testers running CHIPSEC (triggering chipsec.sys PROCESS_MODULE_LOAD and process launch events) to enumerate SPI flash write-protect register states on in-scope systems
- IT provisioning engineers executing Intel FPT (fpt.exe) or AMI AFUWIN during bare-metal imaging workflows to pre-configure BIOS settings before OS deployment
Other platforms for T1542.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate BIOS/UEFI Version and Vendor via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_BIOS' and 'EfiEnvironment'. PowerShell ScriptBlock Log Event ID 4104 with the full script. WMI activity logged in Microsoft-Windows-WMI-Activity/Operational.
- Test 2Execute CHIPSEC Firmware Analysis Tool
Expected signal: Sysmon Event ID 1: Process Create for python.exe with CommandLine containing 'chipsec'. Sysmon Event ID 6 (Driver Loaded): ImageLoaded ending in chipsec.sys, likely Signed=false. Windows System Event ID 7045: ServiceName=chipsec, ServiceFileName pointing to a temp path. If chipsec.sys is extracted to %TEMP%, Sysmon Event ID 11 (File Create) for chipsec.sys.
- Test 3Load RWEverything Privileged Hardware Access Driver (BYOVD Simulation)
Expected signal: Windows System Event ID 7045: ServiceName=RwDrv, ServiceType=kernel mode driver, ServiceFileName=%TEMP%\RwDrv.sys. Windows System Event ID 7036: RwDrv service entered running state. Sysmon Event ID 6 (Driver Loaded): ImageLoaded=%TEMP%\RwDrv.sys with Signed and SignatureStatus fields. Security Event ID 4688 for sc.exe process creation.
- Test 4Create Fake Firmware Image File from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\bios_modified.rom, Image=powershell.exe. Sysmon Event ID 1 (Process Create): powershell.exe CommandLine containing 'bios_modified.rom' and 'WriteAllBytes'. PowerShell ScriptBlock Log Event ID 4104 with the full script content.
References (10)
- https://attack.mitre.org/techniques/T1542/001/
- https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
- https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
- https://github.com/chipsec/chipsec
- https://loldrivers.io/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- https://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about
- https://web.archive.org/web/20170313124421/http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html
- https://www.blackhat.com/docs/us-17/thursday/us-17-Matrosov-The-UEFI-Firmware-Rootkits-Myths-And-Reality.pdf
- https://eclypsium.com/research/the-firmware-supply-chain-problem/
Unlock Pro Content
Get the full detection package for T1542.001 including response playbook, investigation guide, and atomic red team tests.