Detect Component Firmware in Elastic Security
Adversaries may modify component firmware to persist on systems. Some adversaries employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to System Firmware (T1542.001) but conducted upon other system components such as hard drives, network interface cards, and other peripheral devices that may not have the same level of integrity checking. Malicious component firmware provides persistent access that survives disk reimaging, OS reinstallation, and most host-based defenses. Notable examples include the Equation Group's capability to overwrite hard drive firmware across multiple manufacturers (Seagate, Western Digital, Toshiba) and Cyclops Blink's persistent firmware patching of WatchGuard network devices.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.002 Component Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/002/
Elastic Detection Query
sequence by host.name with maxspan=5m
[process where event.type == "start" and (
process.name : ("hdparm", "flashrom", "nvflash", "fwupdmgr", "fwupd-tool", "afuwin", "afudos", "amiflash", "awdflash", "mflash", "ethtool", "sg_write_buffer", "sg3_utils", "nvme", "sdparm", "atapwd", "nls_933w") or
process.args : ("--write-sector", "--yes-i-know-what-i-am-doing", "security-set-pass", "security-unlock", "security-erase", "security-disable", "--flash", "writedmabuf", "--fwdl", "--fw-download", "-d firmware", "download_fw") or
process.args : ("/dev/sda", "/dev/sdb", "/dev/sdc", "/dev/nvme*", "/dev/hda", "/dev/hdb", "\\\\.\\PhysicalDrive*", "\\Device\\Harddisk*")
)
]
// Alternatively, single-event form for broader coverage:
process where event.type == "start" and (
(
process.name : ("hdparm", "flashrom", "nvflash", "fwupdmgr", "fwupd-tool", "afuwin", "afudos", "amiflash", "awdflash", "mflash", "ethtool", "sg_write_buffer", "sg3_utils", "nvme", "sdparm", "atapwd", "nls_933w") and
process.args : ("--write-sector", "--yes-i-know-what-i-am-doing", "security-set-pass", "security-unlock", "security-erase", "security-disable", "--flash", "writedmabuf", "--fwdl", "--fw-download", "-d firmware", "download_fw")
) or
(
process.name : ("hdparm", "flashrom", "nvflash", "fwupdmgr", "fwupd-tool", "afuwin", "afudos", "amiflash", "awdflash", "mflash", "ethtool", "sg_write_buffer") and
process.args : ("/dev/sda", "/dev/sdb", "/dev/sdc", "/dev/nvme*", "/dev/hda", "/dev/hdb")
) or
(
process.args : ("--yes-i-know-what-i-am-doing") and
process.args : ("--write-sector", "security-erase", "security-set-pass")
)
)Detects component firmware modification attempts by monitoring for known firmware utility tools (hdparm, flashrom, nvflash, fwupdmgr, etc.) executing with write/flash operation arguments or accessing raw device paths. Covers T1542.002 persistence techniques used by threat actors like Equation Group and Cyclops Blink.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate firmware update operations performed by system administrators using vendor-approved tools (e.g., fwupdmgr update during scheduled maintenance windows)
- Hard drive diagnostics and health checks run by IT support using hdparm with read-only flags on Linux servers
- Network interface card firmware updates executed by NIC vendor utilities (e.g., ethtool during driver upgrade procedures)
Other platforms for T1542.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Hard Drive Firmware Version Enumeration via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_DiskDrive' and 'FirmwareRevision'. Security Event ID 4688 if command line auditing is enabled. WMI Activity Event ID 5860 in Microsoft-Windows-WMI-Activity/Operational log showing WMI query execution.
- Test 2ATA Disk Identity Read with hdparm (Linux)
Expected signal: Linux auditd syscall record: type=EXECVE msg=audit(...): argc=3 a0='hdparm' a1='-I' a2='/dev/sda'. Syslog entry for sudo privilege escalation. If Sysmon for Linux is deployed, Event ID 1 (Process Create) with Image=/sbin/hdparm and CommandLine containing '/dev/sda'.
- Test 3NVMe Drive Firmware Slot Information Read (Linux)
Expected signal: Linux auditd execve syscall records for nvme with arguments 'fw-log /dev/nvme0' and 'id-ctrl /dev/nvme0'. Syslog sudo authentication entries. Process creation event with raw NVMe device path in command arguments.
- Test 4Firmware Image Staging File Creation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe. Sysmon Event ID 11: File Create with TargetFilename matching *\Temp\hdd_fw_update.bin with .bin extension. The file-based hunting query for .bin/.rom/.fw creation in non-standard directories will match with InitiatingProcessFileName=powershell.exe.
References (7)
- https://attack.mitre.org/techniques/T1542/002/
- https://www.computerworld.com/article/1484887/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
- https://www.smartmontools.org/
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf
- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
- https://linux.die.net/man/8/hdparm
- https://nvmexpress.org/resources/nvme-command-line-interface/
Unlock Pro Content
Get the full detection package for T1542.002 including response playbook, investigation guide, and atomic red team tests.