type: attack-pattern
spec_version: 2.1
id: attack-pattern--6856ddd6-2df3-4379-8b87-284603c189c3
created: 2017-05-31T21:30:28.613Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1019
external_id: T1019
source_name: capec
url: https://capec.mitre.org/data/definitions/532.html
external_id: CAPEC-532
source_name: Wikipedia BIOS
description: Wikipedia. (n.d.). BIOS. Retrieved January 5, 2016.
url: https://en.wikipedia.org/wiki/BIOS
source_name: Wikipedia UEFI
description: Wikipedia. (2017, July 10). Unified Extensible Firmware Interface. Retrieved July 11, 2017.
url: https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface
source_name: About UEFI
description: UEFI Forum. (n.d.). About UEFI Forum. Retrieved January 5, 2016.
url: http://www.uefi.org/about
source_name: MITRE Trustworthy Firmware Measurement
description: Upham, K. (2014, March). Going Deep into the BIOS with MITRE Firmware Security Research. Retrieved January 5, 2016.
url: http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research
source_name: MITRE Copernicus
description: Butterworth, J. (2013, July 30). Copernicus: Question Your Assumptions about BIOS Security. Retrieved December 11, 2015.
url: http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about
source_name: McAfee CHIPSEC Blog
description: Beek, C., Samani, R. (2017, March 8). CHIPSEC Support Against Vault 7 Disclosure Scanning. Retrieved March 13, 2017.
url: https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
source_name: Github CHIPSEC
description: Intel. (2017, March 18). CHIPSEC Platform Security Assessment Framework. Retrieved March 20, 2017.
url: https://github.com/chipsec/chipsec
source_name: Intel HackingTeam UEFI Rootkit
description: Intel Security. (2005, July 16). HackingTeam's UEFI Rootkit Details. Retrieved March 20, 2017.
url: http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:53.631Z
name: System Firmware
description: The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)

System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Ryan Becwar
McAfee
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 1.1