Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Firmware-Level Persistence

Firmware-Level Persistence

2 min read

Jump to:

Overview

Firmware-level persistence is a technique where adversaries implant malicious code within the firmware of hardware components to maintain long-term access to a compromised system. This method enables attackers to survive operating system reinstalls and evade traditional detection mechanisms, making it a critical persistence strategy in advanced attack campaigns.

Attack Objective

Establish durable, stealthy control over a target system beyond software-level defenses
Supports Persistence and Privilege Escalation stages of the attack lifecycle
Advances the attacker’s position by embedding malicious functionality at a low level, enabling re-infection and control even after system resets or reimaging

How the Technique Works

Adversaries modify or replace firmware code on devices such as BIOS, UEFI, network interface cards, or storage controllers. This compromised firmware executes malicious payloads early in the boot process or during hardware initialization, allowing attackers to load malware before the operating system and security controls are active. The persistence mechanism can manipulate system behavior, hide other malware components, or provide covert communication channels.

Common Methods & Variations

Flashing modified BIOS or UEFI firmware images with embedded malware
Compromising firmware on peripheral devices like network cards, hard drives, or embedded controllers
Variants targeting on-premises endpoints, servers, and cloud infrastructure hardware
Use of custom-developed firmware implants versus leveraging legitimate firmware update mechanisms (living-off-the-land)

Indicators of Compromise (IOCs)

Unexpected firmware version changes or unsigned firmware updates detected in system logs
Unusual hardware behavior or boot anomalies recorded in endpoint telemetry
Network anomalies stemming from firmware-level backdoors or covert channels
Alerts from firmware integrity verification tools or hardware security modules

Detection Strategies

Firmware integrity monitoring using cryptographic verification and baseline comparisons
Behavioral analysis of boot processes and hardware initialization sequences
Correlation of endpoint, network, and hardware telemetry to identify anomalies
Use of specialized tools to extract and analyze firmware images for unauthorized modifications

Mitigation & Prevention

Enforce secure boot and trusted platform module (TPM) configurations to prevent unauthorized firmware changes
Apply strict firmware update policies with cryptographic signing and validation
Limit physical and administrative access to hardware components
Implement hardware-based security features and regular firmware integrity assessments

Response Considerations

Isolate affected systems to prevent further compromise and lateral movement
Conduct comprehensive firmware analysis and forensic imaging to assess the scope of infection
Reflash or replace compromised firmware and hardware components as necessary
Review and strengthen firmware update procedures and hardware security controls post-incident

Related Techniques

Bootkit and rootkit techniques that operate at or below the operating system level
Credential access methods that leverage persistent firmware implants
Defense evasion tactics involving tampering with security software or system integrity checks

Mapping & References

MITRE ATT&CK: Persistence – T1542 (Pre-OS Boot), T1542.001 (BIOS/UEFI Firmware)
Public research on firmware attacks by security organizations and hardware vendors
Incident reports detailing firmware-level compromises in targeted attack campaigns

Tags: Advanced Persistent Threats Attack Lifecycle BIOS Defense Evasion endpoint security firmware security hardware security persistence privilege escalation UEFI