Detect Component Firmware in IBM QRadar
Adversaries may modify component firmware to persist on systems. Some adversaries employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to System Firmware (T1542.001) but conducted upon other system components such as hard drives, network interface cards, and other peripheral devices that may not have the same level of integrity checking. Malicious component firmware provides persistent access that survives disk reimaging, OS reinstallation, and most host-based defenses. Notable examples include the Equation Group's capability to overwrite hard drive firmware across multiple manufacturers (Seagate, Western Digital, Toshiba) and Cyclops Blink's persistent firmware patching of WatchGuard network devices.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.002 Component Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/002/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
"username",
"sourceip",
"hostname",
QIDNAME(qid) AS event_name,
"Process Name",
"Command",
"Parent Process",
CASE
WHEN LOWER("Process Name") MATCHES '(hdparm|flashrom|nvflash|fwupd|afuwin|afudos|amiflash|awdflash|mflash|ethtool|sg_write_buffer|sg3_utils|sdparm|atapwd|nls_933w)' THEN 1
ELSE 0
END +
CASE
WHEN LOWER("Command") MATCHES '(--write-sector|--yes-i-know-what-i-am-doing|security-set-pass|security-unlock|security-erase|security-disable|--flash|writedmabuf|--fwdl|--fw-download|download_fw)' THEN 1
ELSE 0
END +
CASE
WHEN LOWER("Command") MATCHES '(physicaldrive|\\\\device\\\\harddisk|/dev/sd[a-z]|/dev/nvme|/dev/hda|/dev/hdb)' THEN 1
ELSE 0
END AS suspicion_score
FROM events
WHERE
LOGSOURCETYPEID IN (12, 13, 433) -- Windows Sysmon, Windows Security, Linux Auth
AND starttime > (CURRENT_TIMESTAMP - 86400000)
AND (
LOWER("Process Name") MATCHES '(hdparm|flashrom|nvflash|fwupd|afuwin|afudos|amiflash|awdflash|mflash|ethtool|sg_write_buffer|sg3_utils|sdparm|atapwd|nls_933w)'
OR (
LOWER("Command") MATCHES '(--write-sector|--yes-i-know-what-i-am-doing|security-set-pass|security-unlock|security-erase|security-disable|--flash|writedmabuf|--fwdl|--fw-download|download_fw)'
AND LOWER("Command") MATCHES '(hdparm|flashrom|nvflash|fwupd|sg_write_buffer|nvme|ethtool)'
)
OR LOWER("Command") MATCHES '(/dev/sd[a-z]|/dev/nvme[0-9]|/dev/hd[ab]|physicaldrive|\\\\device\\\\harddisk)'
)
ORDER BY suspicion_score DESC, starttime DESCQRadar AQL query detecting component firmware modification attempts by matching firmware utility tool names in process image fields and write/flash operation arguments in command line fields. Calculates a suspicion score based on presence of firmware tools, write operations, and raw device path access.
Data Sources
Required Tables
False Positives & Tuning
- Authorized firmware update deployments by IT teams using tools like fwupdmgr through enterprise patch management systems
- Storage administrator diagnostic operations using hdparm or sg3_utils for disk health assessment without write flags
- Hardware vendor support sessions involving firmware flashing of defective components under warranty replacement procedures
Other platforms for T1542.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Hard Drive Firmware Version Enumeration via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_DiskDrive' and 'FirmwareRevision'. Security Event ID 4688 if command line auditing is enabled. WMI Activity Event ID 5860 in Microsoft-Windows-WMI-Activity/Operational log showing WMI query execution.
- Test 2ATA Disk Identity Read with hdparm (Linux)
Expected signal: Linux auditd syscall record: type=EXECVE msg=audit(...): argc=3 a0='hdparm' a1='-I' a2='/dev/sda'. Syslog entry for sudo privilege escalation. If Sysmon for Linux is deployed, Event ID 1 (Process Create) with Image=/sbin/hdparm and CommandLine containing '/dev/sda'.
- Test 3NVMe Drive Firmware Slot Information Read (Linux)
Expected signal: Linux auditd execve syscall records for nvme with arguments 'fw-log /dev/nvme0' and 'id-ctrl /dev/nvme0'. Syslog sudo authentication entries. Process creation event with raw NVMe device path in command arguments.
- Test 4Firmware Image Staging File Creation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe. Sysmon Event ID 11: File Create with TargetFilename matching *\Temp\hdd_fw_update.bin with .bin extension. The file-based hunting query for .bin/.rom/.fw creation in non-standard directories will match with InitiatingProcessFileName=powershell.exe.
References (7)
- https://attack.mitre.org/techniques/T1542/002/
- https://www.computerworld.com/article/1484887/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
- https://www.smartmontools.org/
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf
- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
- https://linux.die.net/man/8/hdparm
- https://nvmexpress.org/resources/nvme-command-line-interface/
Unlock Pro Content
Get the full detection package for T1542.002 including response playbook, investigation guide, and atomic red team tests.