defection.io

malware

BOOTRASH S0114

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 17 November 2024

BOOTRASH is a Bootkit that targets Windows operating systems. It has been used by threat actors that target the financial sector.[1][2][3]

TechniquesBottom 7%

TacticsBottom 12%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

BOOTRASH S0114

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 17 November 2024

BOOTRASH is a Bootkit that targets Windows operating systems. It has been used by threat actors that target the financial sector.[1][2][3]

TechniquesBottom 7%

TacticsBottom 12%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

BOOTRASH MITRE reference S0114

Bootkit T1542.003 ↗

BOOTRASH is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.4 5 6

Persistence · Stealth4 detection rules

Hidden File System T1564.005 ↗

BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.7

Stealthno detection rules

Standing S0114

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques2Bottom 7%

7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics2Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique2medBottom 2%

2nd percentile · 98% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique0med

BOOTRASH detections S0114

4 distinct rules cover the 2 techniques recorded for this malware. 3 Splunk · 1 Sigma.

1 covered by at least one rule1 with no coverage4 distinct rules in total

Showing 1-4 of 4 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects file deletions in the EFI boot directory. (...)	Generic	stable	file_event	linux	Sysmon	Persistence, Stealth Pre-OS Boot System Firmware Bootkit	CVE-2024-7344	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	818a63f8-f2e1-4d1b-ac95-3a4f2ec7f113
	Detects potential malicious and unauthorized usage of bcdedit.exe	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal Persistence, Stealth Pre-OS Boot Bootkit	-	medium	@neu5ron	2019-02-07	2023-02-15	c9fbe8e9-119d-40a6-9b59-dd58a5d84429
Splunk	Detects where a process writes to critical EFI bootloader files (bootmgfw.efi or bootx64.efi) within the \EFI\Boot\ directory. (...)	Generic	stable	file_event	windows	Sysmon	Persistence, Stealth Pre-OS Boot Bootkit	CVE-2024-7344	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	28e1dbcd-9fd2-4de0-a637-f2b30db5dbb9
Splunk	The following analytic detects instances of Winlogon.exe, a critical Windows process, connecting to public IP addresses. (...)	Hunting	stable	process_creation	windows	Sysmon	Persistence, Stealth Pre-OS Boot Bootkit	CVE-2022-21894	medium	Michael Haag, Splunk	2023-05-11	2026-05-13	65615b3a-62ea-4d65-bb9f-6f07c17df4ea