Detect Component Firmware in Splunk
Adversaries may modify component firmware to persist on systems. Some adversaries employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to System Firmware (T1542.001) but conducted upon other system components such as hard drives, network interface cards, and other peripheral devices that may not have the same level of integrity checking. Malicious component firmware provides persistent access that survives disk reimaging, OS reinstallation, and most host-based defenses. Notable examples include the Equation Group's capability to overwrite hard drive firmware across multiple manufacturers (Seagate, Western Digital, Toshiba) and Cyclops Blink's persistent firmware patching of WatchGuard network devices.
MITRE ATT&CK
- Tactic
- Persistence Defense Evasion
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.002 Component Firmware
- Canonical reference
- https://attack.mitre.org/techniques/T1542/002/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval cmd_lower=lower(CommandLine), img_lower=lower(Image)
| eval FirmwareTool=if(
match(img_lower, "(hdparm|flashrom|nvflash|fwupd|afuwin|afudos|amiflash|awdflash|mflash|ethtool|sg_write_buffer|nvme|sdparm|atapwd|nls_933w)"),
1, 0)
| eval WriteOperation=if(
match(cmd_lower, "(--write-sector|--yes-i-know-what-i-am-doing|security-set-pass|security-erase|security-unlock|security-disable|--flash|writedmabuf|--fwdl|--fw-download|download_fw)"),
1, 0)
| eval RawDeviceAccess=if(
match(cmd_lower, "(physicaldrive|\\\\device\\\\harddisk|/dev/sd[a-z]|/dev/nvme|/dev/hda|/dev/hdb)"),
1, 0)
| eval SuspicionScore=FirmwareTool + WriteOperation + RawDeviceAccess
| where SuspicionScore >= 1
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
FirmwareTool, WriteOperation, RawDeviceAccess, SuspicionScore
| sort - SuspicionScore - _timeDetects component firmware modification attempts using Sysmon Event ID 1 (Process Creation) logs. Evaluates process image names against known firmware manipulation tools and evaluates command lines for write operation flags, raw device path arguments, and firmware-specific parameters. A suspicion score helps analysts prioritize: score >= 2 (tool + write operation) warrants urgent investigation; score == 1 may be legitimate diagnostics requiring context review.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate firmware updates from hardware vendors pushed via enterprise management tools such as Dell Command Update, HP Client Management Script Library, or Lenovo System Update Service
- IT administrators using hdparm or smartctl for read-only disk health diagnostics — distinguish with WriteOperation=0 meaning no write flags present
- Network administrators using ethtool for NIC diagnostics and authorized firmware updates on managed switches or HBAs during approved maintenance windows
- Automated OEM diagnostic agents that enumerate raw device paths for hardware inventory or health checks during scheduled scan windows
Other platforms for T1542.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Hard Drive Firmware Version Enumeration via WMI
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Win32_DiskDrive' and 'FirmwareRevision'. Security Event ID 4688 if command line auditing is enabled. WMI Activity Event ID 5860 in Microsoft-Windows-WMI-Activity/Operational log showing WMI query execution.
- Test 2ATA Disk Identity Read with hdparm (Linux)
Expected signal: Linux auditd syscall record: type=EXECVE msg=audit(...): argc=3 a0='hdparm' a1='-I' a2='/dev/sda'. Syslog entry for sudo privilege escalation. If Sysmon for Linux is deployed, Event ID 1 (Process Create) with Image=/sbin/hdparm and CommandLine containing '/dev/sda'.
- Test 3NVMe Drive Firmware Slot Information Read (Linux)
Expected signal: Linux auditd execve syscall records for nvme with arguments 'fw-log /dev/nvme0' and 'id-ctrl /dev/nvme0'. Syslog sudo authentication entries. Process creation event with raw NVMe device path in command arguments.
- Test 4Firmware Image Staging File Creation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe. Sysmon Event ID 11: File Create with TargetFilename matching *\Temp\hdd_fw_update.bin with .bin extension. The file-based hunting query for .bin/.rom/.fw creation in non-standard directories will match with InitiatingProcessFileName=powershell.exe.
References (7)
- https://attack.mitre.org/techniques/T1542/002/
- https://www.computerworld.com/article/1484887/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
- https://www.smartmontools.org/
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf
- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
- https://linux.die.net/man/8/hdparm
- https://nvmexpress.org/resources/nvme-command-line-interface/
Unlock Pro Content
Get the full detection package for T1542.002 including response playbook, investigation guide, and atomic red team tests.