Detect Component Firmware in Microsoft Sentinel
Adversaries may modify component firmware to persist on systems. Some adversaries employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to System Firmware (T1542.001) but conducted upon other system components such as hard drives, network interface cards, and other peripheral devices that may not have the same level of integrity checking. Malicious component firmware provides persistent access that survives disk reimaging, OS reinstallation, and most host-based defenses. Notable examples include the Equation Group's capability to overwrite hard drive firmware across multiple manufacturers (Seagate, Western Digital, Toshiba) and Cyclops Blink's persistent firmware patching of WatchGuard network devices.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.002 Component Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/002/
KQL Detection Query
let FirmwareModificationTools = dynamic([
"hdparm", "flashrom", "nvflash", "fwupdmgr", "fwupd-tool",
"afuwin", "afudos", "amiflash", "awdflash", "mflash",
"ethtool", "sg_write_buffer", "sg3_utils", "nvme", "sdparm",
"atapwd", "nls_933w"
]);
let WriteOperationArgs = dynamic([
"--write-sector", "--yes-i-know-what-i-am-doing",
"security-set-pass", "security-unlock", "security-erase",
"security-disable", "--flash", "writedmabuf",
"--fwdl", "--fw-download", "-d firmware", "download_fw"
]);
let RawDevicePaths = dynamic([
"\\\\.\\PhysicalDrive", "\\\\.\\SCSI", "\\Device\\Harddisk",
"/dev/sda", "/dev/sdb", "/dev/sdc", "/dev/nvme", "/dev/hda", "/dev/hdb"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (FirmwareModificationTools)
or (ProcessCommandLine has_any (FirmwareModificationTools)
and ProcessCommandLine has_any (WriteOperationArgs))
or ProcessCommandLine has_any (RawDevicePaths)
| extend IsFirmwareTool = FileName has_any (FirmwareModificationTools)
| extend IsWriteOperation = ProcessCommandLine has_any (WriteOperationArgs)
| extend IsRawDeviceAccess = ProcessCommandLine has_any (RawDevicePaths)
| extend SuspicionScore = toint(IsFirmwareTool) + toint(IsWriteOperation) + toint(IsRawDeviceAccess)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256,
IsFirmwareTool, IsWriteOperation, IsRawDeviceAccess, SuspicionScore
| sort by SuspicionScore desc, Timestamp descDetects potential component firmware modification attempts using Microsoft Defender for Endpoint DeviceProcessEvents. Identifies known firmware modification tools (hdparm, flashrom, nvflash, BIOS flash utilities, NVMe CLI), write operation arguments associated with firmware flashing, and raw physical device path access. A suspicion score aggregates multiple indicators — higher scores indicate more likely malicious activity versus benign diagnostics.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate firmware updates from hardware vendors pushed via enterprise management tools such as Dell Command Update, HP Client Management Script Library, or Lenovo System Update Service
- IT administrators using hdparm or smartctl for read-only disk health diagnostics (hdparm -I, smartctl -a) — distinguish read versus write operations via command arguments
- Network administrators using ethtool for NIC diagnostics and authorized firmware updates on managed switches or HBAs during approved maintenance windows
- Automated OEM diagnostic agents that enumerate raw device paths for hardware inventory, health checks, or pre-boot environment reporting
Other platforms for T1542.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Hard Drive Firmware Version Enumeration via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_DiskDrive' and 'FirmwareRevision'. Security Event ID 4688 if command line auditing is enabled. WMI Activity Event ID 5860 in Microsoft-Windows-WMI-Activity/Operational log showing WMI query execution.
- Test 2ATA Disk Identity Read with hdparm (Linux)
Expected signal: Linux auditd syscall record: type=EXECVE msg=audit(...): argc=3 a0='hdparm' a1='-I' a2='/dev/sda'. Syslog entry for sudo privilege escalation. If Sysmon for Linux is deployed, Event ID 1 (Process Create) with Image=/sbin/hdparm and CommandLine containing '/dev/sda'.
- Test 3NVMe Drive Firmware Slot Information Read (Linux)
Expected signal: Linux auditd execve syscall records for nvme with arguments 'fw-log /dev/nvme0' and 'id-ctrl /dev/nvme0'. Syslog sudo authentication entries. Process creation event with raw NVMe device path in command arguments.
- Test 4Firmware Image Staging File Creation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe. Sysmon Event ID 11: File Create with TargetFilename matching *\Temp\hdd_fw_update.bin with .bin extension. The file-based hunting query for .bin/.rom/.fw creation in non-standard directories will match with InitiatingProcessFileName=powershell.exe.
References (7)
- https://attack.mitre.org/techniques/T1542/002/
- https://www.computerworld.com/article/1484887/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
- https://www.smartmontools.org/
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf
- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
- https://linux.die.net/man/8/hdparm
- https://nvmexpress.org/resources/nvme-command-line-interface/
Unlock Pro Content
Get the full detection package for T1542.002 including response playbook, investigation guide, and atomic red team tests.