cyberstrikeus T1542 Pre-OS Boot
High-Level Description
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.
Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Kill Chain Phase
- Defense Evasion (TA0005)
- Persistence (TA0003)
Platforms: Linux, Network Devices, Windows, macOS
What to Check
- Identify if Pre-OS Boot technique is applicable to target environment
- Check Linux systems for indicators of Pre-OS Boot
- Check Network Devices systems for indicators of Pre-OS Boot
- Check Windows systems for indicators of Pre-OS Boot
- Verify mitigations are bypassed or absent (5 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to Pre-OS Boot by examining the target platforms (Linux, Network Devices, Windows).
Assess Existing Defenses: Review whether mitigations for T1542 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
M1035 Limit Access to Resource Over Network
Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.
M1047 Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
M1051 Update Software
Patch the BIOS and EFI as necessary.
M1026 Privileged Account Management
Ensure proper permissions are in place to help prevent adversary access to privileged accounts necessary to perform these actions
M1046 Boot Integrity
Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification.
Detection
Detection Strategy for T1542 Pre-OS Boot
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Pre-OS Boot technique applicable | Low | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |