tfMITRE ATT&CK technique
Pre-OS Boot T1542
- Tactics
- Persistence, Stealth
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 2.0
- Created
- 13 November 2019
- Last modified
- 12 May 2026
Sub-techniques 512 rules across the family · 2 mapped directly to T1542 · 3 of 5 carry rules
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.