Detect System Firmware in Elastic Security
Adversaries may modify system firmware (BIOS or UEFI/EFI) to achieve persistent access that survives OS reinstallation and disk replacement. Because firmware executes before the operating system loads, malicious implants planted here are extremely difficult to detect and remove. Attackers typically require a vulnerable or attacker-supplied kernel-mode driver to gain ring-0 access to SPI flash memory before overwriting or patching the firmware image. Real-world examples include LoJax (Fancy Bear/APT28), which repurposed the legitimate LoJack anti-theft agent's UEFI module; Trojan.Mebromi, which modified the Award BIOS; and the Hacking Team UEFI Rootkit. Detection must focus on observable pre-conditions and side-effects: execution of firmware analysis and flashing utilities, loading of privileged hardware-access drivers, suspicious UEFI variable modification, and creation of raw firmware image files.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.001 System Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/001/
Elastic Detection Query
any where
(
event.category == "process" and event.type == "start" and
(
process.name in~ ("chipsec.exe", "flashrom.exe", "RWEverything.exe", "RwDrv.exe",
"AFUWIN.exe", "AFUWIN64.exe", "fpt.exe", "fptw.exe", "fptw64.exe",
"FWUpdate.exe", "biosflash.exe", "meinfo.exe", "meinfowin.exe",
"AmiBIOSCoreUtil.exe", "UEFITool.exe", "iflash.exe")
or process.command_line : ("*chipsec*", "*flashrom*", "*SpiFlash*", "*bios.rom*",
"*uefi.rom*", "*bios.bin*", "*bios_backup*", "*flash_bios*",
"*RWEverything*", "*/writephysmem*", "*/readphysmem*")
)
)
or
(
event.category == "driver" and
(
dll.name in~ ("RwDrv.sys", "sednit.sys", "chipsec.sys", "WinIo.sys", "WinIo64.sys",
"PhyMemX64.sys", "DirectIO64.sys", "asmmap64.sys", "gdrv.sys",
"bsflash64.sys", "inpoutx64.sys", "hwrwdrv.sys", "lenovoemc.sys", "atkwio.sys")
or (
dll.path : ("*\\Temp\\*", "*\\Downloads\\*", "*\\AppData\\*") and
dll.name : "*.sys" and
not process.name in~ ("MsMpEng.exe", "svchost.exe", "services.exe")
)
)
)
or
(
event.category == "file" and event.type == "creation" and
(
file.name : ("*.rom", "*.fd", "*.cap")
or (
file.name : "*.bin" and
not file.path : ("C:\\Windows\\*", "C:\\Program Files\\*") and
not process.name in~ ("svchost.exe", "MsMpEng.exe", "TrustedInstaller.exe")
)
)
)Detects T1542.001 System Firmware modification across four behavioral branches using Elastic ECS: (1) execution of known firmware analysis and flashing utilities via process.name and process.command_line, (2) loading of named privileged hardware-access kernel drivers used for ring-0 SPI flash access via dll.name and dll.path, (3) unsigned drivers loaded from writable user paths by non-system processes, and (4) raw firmware image file creation (.rom, .fd, .cap) or suspicious .bin files outside Windows/ProgramFiles paths. Covers Sysmon EID 1, 6, and 11 equivalent telemetry ingested via Elastic Endpoint or Winlogbeat.
Data Sources
Required Tables
False Positives & Tuning
- OEM vendor firmware update utilities (Dell Command Update, HP System Firmware Update, Lenovo Vantage) legitimately invoke AFUWIN64.exe or fpt.exe and create .cap or .bin files during scheduled BIOS update cycles
- Authorized security researchers or hardware validation engineers using CHIPSEC to enumerate SPI flash write protections on designated test systems as part of platform security assessments
- Enterprise hardware provisioning workflows where Intel ME Configuration Tool or AMI flash utilities are executed by IT during imaging to configure initial BIOS settings on new endpoints
Other platforms for T1542.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate BIOS/UEFI Version and Vendor via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_BIOS' and 'EfiEnvironment'. PowerShell ScriptBlock Log Event ID 4104 with the full script. WMI activity logged in Microsoft-Windows-WMI-Activity/Operational.
- Test 2Execute CHIPSEC Firmware Analysis Tool
Expected signal: Sysmon Event ID 1: Process Create for python.exe with CommandLine containing 'chipsec'. Sysmon Event ID 6 (Driver Loaded): ImageLoaded ending in chipsec.sys, likely Signed=false. Windows System Event ID 7045: ServiceName=chipsec, ServiceFileName pointing to a temp path. If chipsec.sys is extracted to %TEMP%, Sysmon Event ID 11 (File Create) for chipsec.sys.
- Test 3Load RWEverything Privileged Hardware Access Driver (BYOVD Simulation)
Expected signal: Windows System Event ID 7045: ServiceName=RwDrv, ServiceType=kernel mode driver, ServiceFileName=%TEMP%\RwDrv.sys. Windows System Event ID 7036: RwDrv service entered running state. Sysmon Event ID 6 (Driver Loaded): ImageLoaded=%TEMP%\RwDrv.sys with Signed and SignatureStatus fields. Security Event ID 4688 for sc.exe process creation.
- Test 4Create Fake Firmware Image File from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\bios_modified.rom, Image=powershell.exe. Sysmon Event ID 1 (Process Create): powershell.exe CommandLine containing 'bios_modified.rom' and 'WriteAllBytes'. PowerShell ScriptBlock Log Event ID 4104 with the full script content.
References (10)
- https://attack.mitre.org/techniques/T1542/001/
- https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
- https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
- https://github.com/chipsec/chipsec
- https://loldrivers.io/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- https://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about
- https://web.archive.org/web/20170313124421/http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html
- https://www.blackhat.com/docs/us-17/thursday/us-17-Matrosov-The-UEFI-Firmware-Rootkits-Myths-And-Reality.pdf
- https://eclypsium.com/research/the-firmware-supply-chain-problem/
Unlock Pro Content
Get the full detection package for T1542.001 including response playbook, investigation guide, and atomic red team tests.