domains / families / security / hunting-bootkits-in-efi-system-partition

hunting-bootkits-in-efi-system-partition

separate

Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall.

When to use

• During proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003 — Pre-OS Boot: Bootkit)
• After an incident where an adversary achieved SYSTEM/root and may have established below-OS persistence
• When validating Secure Boot posture across a fleet and confirming boot-chain integrity
• As a periodic integrity check, comparing the current ESP contents against a trusted golden baseline
• When triaging hosts that show measured-boot (TPM PCR) mismatches

Skill page

Source