tfMITRE ATT&CK sub-technique

Bootkit T1542.003

Tactics: Persistence, Stealth
Platforms: Linux, Windows
Version: 2.0
Created: 19 December 2019
Last modified: 12 May 2026

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Bootkit MITRE reference T1542.003

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT41G0096 ↗

Deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.1

created 2019-09-231 referenceaka Wicked Panda

Lazarus GroupG0032 ↗

Malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

APT28G0007 ↗

Has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 3 groups for this technique

Offense vs defense T1542.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 3

first rule: 2019 Q1

Bootkit detection strategy DET0150

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for File Creation or Modification of Boot Files

Enterprise

2 platforms

AN0428 · Windows

Detection of raw access to physical drives, modification of boot records (MBR/VBR), and suspicious file creation or alteration within the EFI System Partition (ESP). Correlates privileged process execution with low-level disk modification and unexpected driver or firmware interactions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Drive AccessDC0054	WinEventLog:Sysmon	EventCode=9

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
KnownGoodMBRHashes	Baseline hashes of clean MBR/VBR sectors for comparison
ESPFileWhitelist	Approved EFI executables within ESP directories
TimeWindow	Correlation window between privileged access, raw disk modification, and EFI file creation

AN0429 · Linux

Detection of suspicious write operations to block devices, modifications of bootloader files (GRUB, initrd, vmlinuz), and unexpected changes within the EFI System Partition. Monitors privileged execution of utilities like dd, grub-install, or efibootmgr that modify boot sectors or loader entries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive ModificationDC0046	linux:syslog	Block device write errors or unusual bootloader activity
File ModificationDC0061	auditd:SYSCALL	open, write: Write operations targeting /dev/sda, /dev/nvme0n1, or EFI partition mounts

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BootloaderHashBaseline	Baseline checksums of GRUB, kernel, and initramfs images
EFIFileAllowlist	Trusted EFI executables for Linux environments
AlertThresholds	Tunable thresholds for triggering alerts on repeated EFI/bootloader writes

Bootkit detections T1542.003

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs