AN0916
Analytic 0916
Windows
Detection of anomalous driver and firmware interactions, including unsigned or unexpected firmware updates, driver loads linked to hardware components, and suspicious use of privileged APIs to read/write firmware or controller memory.
WinEventLog:Sysmon
EventCode=6
firmware:integrity
Firmware integrity verification failures or mismatches against expected UEFI/firmware image baselines
[KnownGoodFirmwareHashes]
Environment-specific list of baseline firmware images for integrity comparison
[DriverAllowList]
Drivers approved for loading in production environments
[TimeWindow]
Correlation period between firmware modification attempt and abnormal driver or process behavior
AN0917
Analytic 0917
Linux
Detection of suspicious use of ioctl/sysfs calls to access device firmware, unexpected flashing tools execution, and anomalous firmware checksums logged by SMART or kernel audit mechanisms.
auditd:SYSCALL
ioctl/write: Direct firmware update or device memory manipulation syscalls
linux:syslog
Driver load events or firmware load failures for hardware devices
[FirmwareImageBaseline]
Baseline firmware checksums for comparison
[AlertThresholds]
Tolerance levels for SMART errors before triggering alerts
AN0918
Analytic 0918
macOS
Detection of EFI/firmware manipulation attempts via abnormal driver loads, unsigned kexts, or tampered NVRAM variables associated with component firmware configuration.
macos:unifiedlog
Firmware update events or kernel extension (kext) loads not signed by Apple
[ApprovedKextList]
List of trusted and signed kexts permitted in production systems
[EFIHashBaseline]
Known-clean EFI image hashes used for verification