ATT&CK · T1542
Pre-OS Boot
Tactics: stealth, persistence
About
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control. Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Used by actors
0 known groups
No mapped actors.
Software
0 malware/tools implement this
None mapped.
Corpus indicators tagged with this technique
0 indicators in the corpus carry T1542.
No corpus indicators are tagged with this technique yet.