Detect System Firmware in CrowdStrike LogScale
Adversaries may modify system firmware (BIOS or UEFI/EFI) to achieve persistent access that survives OS reinstallation and disk replacement. Because firmware executes before the operating system loads, malicious implants planted here are extremely difficult to detect and remove. Attackers typically require a vulnerable or attacker-supplied kernel-mode driver to gain ring-0 access to SPI flash memory before overwriting or patching the firmware image. Real-world examples include LoJax (Fancy Bear/APT28), which repurposed the legitimate LoJack anti-theft agent's UEFI module; Trojan.Mebromi, which modified the Award BIOS; and the Hacking Team UEFI Rootkit. Detection must focus on observable pre-conditions and side-effects: execution of firmware analysis and flashing utilities, loading of privileged hardware-access drivers, suspicious UEFI variable modification, and creation of raw firmware image files.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.001 System Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/001/
LogScale Detection Query
#event_simpleName in ("ProcessRollup2", "DriverLoad", "FileCreate", "ServiceInstall")
| case {
#event_simpleName = "ProcessRollup2"
| where
ImageFileName = /(?i)(chipsec\.exe|flashrom\.exe|RWEverything\.exe|RwDrv\.exe|AFUWIN64?\.exe|fptw?64?\.exe|FWUpdate\.exe|biosflash\.exe|meinfo\.exe|UEFITool\.exe|iflash\.exe|AmiBIOSCoreUtil\.exe)/
OR CommandLine = /(?i)(chipsec|flashrom|SpiFlash|bios\.rom|uefi\.rom|bios\.bin|bios_backup|flash_bios|RWEverything|writephysmem|readphysmem)/
| DetectionType := "FirmwareTool_Execution"
| IndicatorDetail := format("Process: %s | CMD: %s", ImageFileName, CommandLine) ;
#event_simpleName = "DriverLoad"
| where
ImageFileName = /(?i)(RwDrv\.sys|sednit\.sys|chipsec\.sys|WinIo64?\.sys|PhyMemX64\.sys|DirectIO64\.sys|asmmap64\.sys|gdrv\.sys|bsflash64\.sys|inpoutx64\.sys|hwrwdrv\.sys|lenovoemc\.sys|atkwio\.sys)/
| DetectionType := "HardwareAccess_Driver_Load"
| IndicatorDetail := format("Driver: %s", ImageFileName) ;
#event_simpleName = "ServiceInstall"
| where
(
ServiceFileName = /(?i)(\\Temp\\|\\Users\\|\\ProgramData\\|\\Downloads\\)/
AND ServiceFileName = /\.sys$/i
)
OR ServiceName = /(?i)(RwDrv|chipsec|WinIo|DirectIO|PhyMem|asmmap|gdrv|inpout)/
| DetectionType := "SuspiciousKernelDriver_Installed"
| IndicatorDetail := format("Service: %s | Path: %s", ServiceName, ServiceFileName) ;
#event_simpleName = "FileCreate"
| where
(
TargetFileName = /(?i)\.(rom|fd|cap)$/
OR (
TargetFileName = /(?i)\.bin$/
AND NOT TargetFileName = /(?i)(\\Windows\\|\\Program Files\\)/
)
)
AND NOT ImageFileName = /(?i)(svchost\.exe|MsMpEng\.exe|TrustedInstaller\.exe)/
| DetectionType := "FirmwareImage_FileCreated"
| IndicatorDetail := format("File: %s | By: %s", TargetFileName, ImageFileName) ;
}
| table([#timestamp, ComputerName, UserName, DetectionType, IndicatorDetail, ImageFileName, CommandLine, TargetFileName, MD5HashData, SHA256HashData])
| sort(field=#timestamp, order=desc)CrowdStrike Falcon LogScale (Humio) detection for T1542.001 System Firmware using native Falcon telemetry event streams. Queries four event types via case branching: ProcessRollup2 for firmware tool execution matching known binary names and CLI patterns; DriverLoad for privileged hardware-access kernel drivers that provide ring-0 SPI flash write access (prerequisite for UEFI implantation); ServiceInstall for suspicious kernel driver service registration from user-writable paths or by known malicious service name patterns; and FileCreate for raw firmware image artifacts (.rom, .fd, .cap) or .bin files outside system directories not written by trusted processes. Each branch annotates a DetectionType and IndicatorDetail for alert enrichment.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate BIOS update workflows initiated by Lenovo Vantage, Dell SupportAssist, or HP Support Solutions Framework that invoke vendor-signed AFUWIN64.exe or fpt.exe and write .cap or .bin firmware update packages to staging directories
- Authorized security assessments using CHIPSEC — which registers chipsec.sys as a kernel driver service loaded from a temporary path — to validate SPI write-protect configurations on approved test endpoints
- Hardware OEM quality assurance environments where Intel Flash Programming Tool (fpt.exe) and associated drivers are executed routinely by engineers to verify firmware integrity across device configurations
Other platforms for T1542.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate BIOS/UEFI Version and Vendor via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_BIOS' and 'EfiEnvironment'. PowerShell ScriptBlock Log Event ID 4104 with the full script. WMI activity logged in Microsoft-Windows-WMI-Activity/Operational.
- Test 2Execute CHIPSEC Firmware Analysis Tool
Expected signal: Sysmon Event ID 1: Process Create for python.exe with CommandLine containing 'chipsec'. Sysmon Event ID 6 (Driver Loaded): ImageLoaded ending in chipsec.sys, likely Signed=false. Windows System Event ID 7045: ServiceName=chipsec, ServiceFileName pointing to a temp path. If chipsec.sys is extracted to %TEMP%, Sysmon Event ID 11 (File Create) for chipsec.sys.
- Test 3Load RWEverything Privileged Hardware Access Driver (BYOVD Simulation)
Expected signal: Windows System Event ID 7045: ServiceName=RwDrv, ServiceType=kernel mode driver, ServiceFileName=%TEMP%\RwDrv.sys. Windows System Event ID 7036: RwDrv service entered running state. Sysmon Event ID 6 (Driver Loaded): ImageLoaded=%TEMP%\RwDrv.sys with Signed and SignatureStatus fields. Security Event ID 4688 for sc.exe process creation.
- Test 4Create Fake Firmware Image File from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\bios_modified.rom, Image=powershell.exe. Sysmon Event ID 1 (Process Create): powershell.exe CommandLine containing 'bios_modified.rom' and 'WriteAllBytes'. PowerShell ScriptBlock Log Event ID 4104 with the full script content.
References (10)
- https://attack.mitre.org/techniques/T1542/001/
- https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
- https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
- https://github.com/chipsec/chipsec
- https://loldrivers.io/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- https://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about
- https://web.archive.org/web/20170313124421/http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html
- https://www.blackhat.com/docs/us-17/thursday/us-17-Matrosov-The-UEFI-Firmware-Rootkits-Myths-And-Reality.pdf
- https://eclypsium.com/research/the-firmware-supply-chain-problem/
Unlock Pro Content
Get the full detection package for T1542.001 including response playbook, investigation guide, and atomic red team tests.