Detect System Firmware in Splunk
Adversaries may modify system firmware (BIOS or UEFI/EFI) to achieve persistent access that survives OS reinstallation and disk replacement. Because firmware executes before the operating system loads, malicious implants planted here are extremely difficult to detect and remove. Attackers typically require a vulnerable or attacker-supplied kernel-mode driver to gain ring-0 access to SPI flash memory before overwriting or patching the firmware image. Real-world examples include LoJax (Fancy Bear/APT28), which repurposed the legitimate LoJack anti-theft agent's UEFI module; Trojan.Mebromi, which modified the Award BIOS; and the Hacking Team UEFI Rootkit. Detection must focus on observable pre-conditions and side-effects: execution of firmware analysis and flashing utilities, loading of privileged hardware-access drivers, suspicious UEFI variable modification, and creation of raw firmware image files.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.001 System Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/001/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:System")
(
(EventCode=1
(
Image IN ("*\\chipsec.exe", "*\\flashrom.exe", "*\\RWEverything.exe", "*\\RwDrv.exe",
"*\\AFUWIN.exe", "*\\AFUWIN64.exe", "*\\fpt.exe", "*\\fptw.exe", "*\\fptw64.exe",
"*\\FWUpdate.exe", "*\\biosflash.exe", "*\\meinfo.exe", "*\\iflash.exe",
"*\\UEFITool.exe", "*\\AmiBIOSCoreUtil.exe")
OR match(CommandLine, "(?i)(chipsec|flashrom|SpiFlash|bios\.rom|uefi\.rom|bios\.bin|uefi\.bin|bios_backup|flash_bios|RWEverything|\/writephysmem|\/readphysmem)")
)
)
OR
(EventCode=6
match(ImageLoaded, "(?i)(RwDrv\.sys|sednit\.sys|chipsec\.sys|WinIo\.sys|WinIo64\.sys|PhyMemX64\.sys|DirectIO64\.sys|asmmap64\.sys|gdrv\.sys|bsflash64\.sys|inpoutx64\.sys|hwrwdrv\.sys|lenovoemc\.sys)")
)
OR
(EventCode=7045
(
match(ServiceFileName, "(?i)(\\\\Temp\\\\|\\\\Users\\\\|\\\\ProgramData\\\\|\\\\Downloads\\\\).*\.sys")
OR match(ServiceName, "(?i)(RwDrv|chipsec|WinIo|DirectIO|PhyMem|asmmap|gdrv|inpout)")
)
)
OR
(EventCode=11
match(TargetFilename, "(?i)\.(rom|fd|cap)$")
NOT match(Image, "(?i)(svchost\.exe|MsMpEng\.exe|trustedinstaller\.exe|wuauclt\.exe)")
)
)
| eval EventType=case(
EventCode=1, "FirmwareTool_Execution",
EventCode=6, "HardwareAccess_Driver_Load",
EventCode=7045, "SuspiciousKernelDriver_Installed",
EventCode=11, "FirmwareImage_FileCreated",
true(), "Unknown"
)
| eval IndicatorDetail=case(
EventCode=1, "Process: ".Image." | CMD: ".CommandLine,
EventCode=6, "Driver loaded: ".ImageLoaded." | Signed: ".Signed,
EventCode=7045, "Service: ".ServiceName." | Path: ".ServiceFileName,
EventCode=11, "File: ".TargetFilename." | By: ".Image,
true(), ""
)
| table _time, host, EventType, IndicatorDetail, User, Hashes, Signed
| sort - _timeMulti-event detection for BIOS/UEFI firmware attack indicators using Sysmon and Windows System event logs. EventCode=1 (Process Create) catches execution of known firmware flashing and analysis tools by Image name or command-line pattern. EventCode=6 (Driver Loaded) identifies loading of privileged hardware-access drivers used to gain SPI flash memory access. EventCode=7045 (Service Install from WinEventLog:System) detects kernel driver services installed from anomalous user-writable paths. EventCode=11 (File Create) flags creation of raw firmware image files (.rom, .fd, .cap) by non-system processes. An EventType field categorizes each alert for triage.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate OEM BIOS update tools (Dell Command Update, HP BIOS Update, Lenovo Firmware Update) that load vendor-signed flash drivers and create .cap or .fd firmware image files
- Security researchers running chipsec or UEFI forensic tooling on dedicated analysis hosts — should be excluded by hostname allowlist rather than process pattern
- Enterprise device management platforms (SCCM, BigFix, Intune) that orchestrate BIOS updates and temporarily install vendor flash drivers with recognizable service names
- Hardware diagnostics software bundled with workstation imaging that loads low-level I/O drivers during provisioning workflows
- Dual-use security tools like RWEverything used by IT staff for hardware troubleshooting — should require explicit authorization
Other platforms for T1542.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate BIOS/UEFI Version and Vendor via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_BIOS' and 'EfiEnvironment'. PowerShell ScriptBlock Log Event ID 4104 with the full script. WMI activity logged in Microsoft-Windows-WMI-Activity/Operational.
- Test 2Execute CHIPSEC Firmware Analysis Tool
Expected signal: Sysmon Event ID 1: Process Create for python.exe with CommandLine containing 'chipsec'. Sysmon Event ID 6 (Driver Loaded): ImageLoaded ending in chipsec.sys, likely Signed=false. Windows System Event ID 7045: ServiceName=chipsec, ServiceFileName pointing to a temp path. If chipsec.sys is extracted to %TEMP%, Sysmon Event ID 11 (File Create) for chipsec.sys.
- Test 3Load RWEverything Privileged Hardware Access Driver (BYOVD Simulation)
Expected signal: Windows System Event ID 7045: ServiceName=RwDrv, ServiceType=kernel mode driver, ServiceFileName=%TEMP%\RwDrv.sys. Windows System Event ID 7036: RwDrv service entered running state. Sysmon Event ID 6 (Driver Loaded): ImageLoaded=%TEMP%\RwDrv.sys with Signed and SignatureStatus fields. Security Event ID 4688 for sc.exe process creation.
- Test 4Create Fake Firmware Image File from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\bios_modified.rom, Image=powershell.exe. Sysmon Event ID 1 (Process Create): powershell.exe CommandLine containing 'bios_modified.rom' and 'WriteAllBytes'. PowerShell ScriptBlock Log Event ID 4104 with the full script content.
References (10)
- https://attack.mitre.org/techniques/T1542/001/
- https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
- https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
- https://github.com/chipsec/chipsec
- https://loldrivers.io/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- https://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about
- https://web.archive.org/web/20170313124421/http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html
- https://www.blackhat.com/docs/us-17/thursday/us-17-Matrosov-The-UEFI-Firmware-Rootkits-Myths-And-Reality.pdf
- https://eclypsium.com/research/the-firmware-supply-chain-problem/
Unlock Pro Content
Get the full detection package for T1542.001 including response playbook, investigation guide, and atomic red team tests.