Esc

Bootkit - T1542.003

(ATT&CK® Technique)

Definition

Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1542003["Bootkit"] --> |may-modify| BootLoader["Boot Loader"]; class T1542003 OffensiveTechniqueNode;
        class BootLoader ArtifactNode; click BootLoader href "/dao/artifact/d3f:BootLoader";
        click T1542003 href "/offensive-technique/attack/T1542.003/"; click BootLoader href "/dao/artifact/d3f:BootLoader"; T1542003["Bootkit"] --> |may-modify| BootSector["Boot Sector"]; class T1542003 OffensiveTechniqueNode;
        class BootSector ArtifactNode; click BootSector href "/dao/artifact/d3f:BootSector";
        click T1542003 href "/offensive-technique/attack/T1542.003/"; click BootSector href "/dao/artifact/d3f:BootSector"; T1542003["Bootkit"] --> |may-modify| VolumeBootRecord["Volume Boot Record"]; class T1542003 OffensiveTechniqueNode;
        class VolumeBootRecord ArtifactNode; click VolumeBootRecord href "/dao/artifact/d3f:VolumeBootRecord";
        click T1542003 href "/offensive-technique/attack/T1542.003/"; click VolumeBootRecord href "/dao/artifact/d3f:VolumeBootRecord";                                       SoftwareUpdate["Software Update"] -->
          | updates | BootLoader["Boot Loader"];

          SoftwareUpdate["Software Update"] -.->
            | may-harden | T1542003["Bootkit"] ;
          class SoftwareUpdate DefensiveTechniqueNode;
          class BootLoader ArtifactNode;
          click SoftwareUpdate href "/technique/d3f:SoftwareUpdate";  BootloaderAuthentication["Bootloader Authentication"] -->
          | authenticates | BootLoader["Boot Loader"];

          BootloaderAuthentication["Bootloader Authentication"] -.->
            | may-harden | T1542003["Bootkit"] ;
          class BootloaderAuthentication DefensiveTechniqueNode;
          class BootLoader ArtifactNode;
          click BootloaderAuthentication href "/technique/d3f:BootloaderAuthentication";                          RestoreSoftware["Restore Software"] -->
          | restores | BootLoader["Boot Loader"];

          RestoreSoftware["Restore Software"] -.->
            | may-restore | T1542003["Bootkit"] ;
          class RestoreSoftware DefensiveTechniqueNode;
          class BootLoader ArtifactNode;
          click RestoreSoftware href "/technique/d3f:RestoreSoftware";

json