domains / families / security / analyzing-uefi-bootkit-persistence

analyzing-uefi-bootkit-persistence

separate

'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

When to use

• A compromised system re-establishes C2 communication after OS reinstallation or disk replacement
• Secure Boot has been tampered with, disabled, or shows unexpected Machine Owner Key (MOK) enrollment
• Firmware integrity verification fails against vendor-provided baselines
• Memory forensics reveals rootkit components loading during early boot phase
• Investigating advanced persistent threat (APT) campaigns known to deploy UEFI implants
• Auditing firmware security posture for enterprise endpoint hardening

When not to use

• standard MBR-based bootkits on legacy BIOS systems without UEFI

Skill page

Source