T1542No distinct observable

Pre-OS Boot

Stealth · PersistenceLinux, macOS, Network Devices, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

AN0774 (Windows) is built on the same three log sources as T1542.001's AN0275 — Security 4688, Sysmon EventID 9 (raw_access_thread) and EventID 11 (file_event) — and its description is the union of two children's observables rather than anything distinct to the parent: 'firmware update tools' and 'API calls writing directly to raw disk sectors' is System Firmware's mechanism (AN0275: 'fwupdate.exe or vendor flash tools', 'raw disk writes targeting System Firmware GUID partitions'), and 'modification of boot records (MBR, VBR)' is Bootkit's mechanism verbatim (AN0428: 'modification of boot records (MBR/VBR), and suspicious file creation... within the EFI System Partition'). […]

Covered instead by T1542.001, T1542.002, T1542.003.

What the technique is

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control. Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Read it on attack.mitre.org

What MITRE says you would watch

AN0774
Unusual modification of boot records (MBR, VBR) or EFI partitions not associated with legitimate patch cycles or OS upgrades. Registry or WMI events associated with firmware update tools executed from unexpected parent processes. API calls (e.g., DeviceIoControl) writing directly to raw disk sectors. Subsequent abnormal boot configuration changes followed by unsigned driver loads.
AN0775
Detection of writes to /boot or EFI directories outside of expected package manager updates. Monitoring kernel log and auditd events for attempts to overwrite bootloader binaries (e.g., grub, shim). Unexpected execution of efibootmgr or dd writing to /dev/sdX devices followed by boot parameter changes.
AN0776
Abnormal modification of EFI firmware binaries in /System/Library/CoreServices/ or NVRAM parameters not associated with OS updates. Unified logs capturing calls to bless or nvram commands executed from untrusted parent processes. Sudden unsigned kext loads after EFI variable tampering.