2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, adversaries performed a factory-reset on compromised devices that hampered forensic investigations.1
tfMITRE ATT&CK technique
Firmware Corruption T1495
- Tactic
- Impact
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.3
- Created
- 12 April 2019
- Last modified
- 12 May 2026
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.[1] Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Firmware Corruption MITRE reference T1495
72nd pctamong all ATT&CK techniques for number of campaigns
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
All 1 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Bad RabbitS0606 ↗
Has used an executable that installs a modified bootloader to prevent normal boot-up.1
TrickBotS0266 ↗
Module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.1
All 2 software entries for this technique
Offense vs defense T1495
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2019 Q3 · 1 of 1 campaigns plottedFirmware Corruption detection strategy DET0167
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Firmware Modification via Flash Tool or Corrupted Firmware Upload
4 platforms
AN0474 · Windows
Firmware flash utility invoked with elevated privileges followed by raw access to firmware device path or changes to boot configuration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Firmware ModificationDC0004 | WinEventLog:Microsoft-Windows-Kernel-Boot | Firmware integrity validation failed or boot configuration tampered |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Driver LoadDC0079 | WinEventLog:Sysmon | EventCode=6 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentImage | Common legitimate flash tool chains can be allowlisted |
| CommandLine | Flags indicating silent or forced flash may vary |
AN0475 · Linux
Direct write access to /dev/mem or /sys/firmware combined with usage of firmware flashing utilities (e.g., flashrom).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Firmware ModificationDC0004 | auditd:SYSCALL | write access to /dev/mem or /sys/firmware/efi/efivars |
| Process CreationDC0032 | auditd:SYSCALL | execution of known flash tools (e.g., flashrom, fwupd) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ToolName | Custom or renamed firmware tools may require pattern matching |
AN0476 · macOS
EFI updates executed via system processes or binaries outside of expected patch windows or using unsigned firmware packages.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Firmware ModificationDC0004 | macos:unifiedlog | boot failure events or SMC validation errors |
| Process CreationDC0032 | macos:unifiedlog | com.apple.firmwareupdater activity or update-firmware binary invoked |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UpdateTimeWindow | Firmware updates usually occur after OS update; out-of-band patterns may indicate compromise |
AN0477 · Network Devices
Firmware image uploaded via TFTP/SCP or web interface followed by reboot or unexpected loss of connectivity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Firmware ModificationDC0004 | networkdevice:firmware | Firmware update initiated or bootloader tampering detected |
| Network Traffic ContentDC0085 | NSM:Flow | large upload to firmware interface port or path |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UploadSizeThreshold | Size of firmware images varies by vendor |
| RebootWindow | Reboots outside of patch maintenance may be suspicious |
Boot IntegrityM1046
Check the integrity of the existing BIOS and device firmware to determine if it is vulnerable to modification.
Prevent adversary access to privileged accounts or access necessary to replace system firmware.
Update SoftwareM1051
Patch the BIOS and other firmware as necessary to prevent successful use of known vulnerabilities.