tfMITRE ATT&CK sub-technique

Component Firmware T1542.002

Tactics: Persistence, Stealth
Platforms: Windows, Linux, macOS
Version: 2.0
Created: 19 December 2019
Last modified: 12 May 2026

Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to System Firmware but conducted upon other system components/devices that may not have the same capability or level of integrity checking.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Component Firmware MITRE reference T1542.002

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

EquationG0020 ↗

Is known to have the capability to overwrite the firmware on hard drives from some manufacturers.1

created 2017-05-311 reference

All 1 groups for this technique

Offense vs defense T1542.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Component Firmware detection strategy DET0323

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1542.002 Pre-OS Boot: Component Firmware

Enterprise

3 platforms

AN0916 · Windows

Detection of anomalous driver and firmware interactions, including unsigned or unexpected firmware updates, driver loads linked to hardware components, and suspicious use of privileged APIs to read/write firmware or controller memory.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firmware ModificationDC0004	firmware:integrity	Firmware integrity verification failures or mismatches against expected UEFI/firmware image baselines
Driver LoadDC0079	WinEventLog:Sysmon	EventCode=6

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
KnownGoodFirmwareHashes	Environment-specific list of baseline firmware images for integrity comparison
DriverAllowList	Drivers approved for loading in production environments
TimeWindow	Correlation period between firmware modification attempt and abnormal driver or process behavior

AN0917 · Linux

Detection of suspicious use of ioctl/sysfs calls to access device firmware, unexpected flashing tools execution, and anomalous firmware checksums logged by SMART or kernel audit mechanisms.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firmware ModificationDC0004	auditd:SYSCALL	ioctl/write: Direct firmware update or device memory manipulation syscalls
Driver LoadDC0079	linux:syslog	Driver load events or firmware load failures for hardware devices

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FirmwareImageBaseline	Baseline firmware checksums for comparison
AlertThresholds	Tolerance levels for SMART errors before triggering alerts

AN0918 · macOS

Detection of EFI/firmware manipulation attempts via abnormal driver loads, unsigned kexts, or tampered NVRAM variables associated with component firmware configuration.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firmware ModificationDC0004	macos:unifiedlog	Firmware update events or kernel extension (kext) loads not signed by Apple

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedKextList	List of trusted and signed kexts permitted in production systems
EFIHashBaseline	Known-clean EFI image hashes used for verification

Component Firmware detections T1542.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs