AN0774
Analytic 0774
Windows
Unusual modification of boot records (MBR, VBR) or EFI partitions not associated with legitimate patch cycles or OS upgrades. Registry or WMI events associated with firmware update tools executed from unexpected parent processes. API calls (e.g., DeviceIoControl) writing directly to raw disk sectors. Subsequent abnormal boot configuration changes followed by unsigned driver loads.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=9
[AllowedFirmwareUpdateTools]
Legitimate vendor tools or processes authorized to modify firmware or boot records.
[TimeWindow]
Correlating boot-sector modification with subsequent reboot events.
[EntropyThreshold]
Heuristic threshold for detecting obfuscated/packed boot code.
AN0775
Analytic 0775
Linux
Detection of writes to /boot or EFI directories outside of expected package manager updates. Monitoring kernel log and auditd events for attempts to overwrite bootloader binaries (e.g., grub, shim). Unexpected execution of efibootmgr or dd writing to /dev/sdX devices followed by boot parameter changes.
auditd:SYSCALL
open, write: Modification of /boot/grub/* or /boot/efi/*
auditd:EXECVE
exec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions
[PackageManagerUpdateWhitelist]
Allowlist of legitimate grub/shim updates via apt, yum, or rpm.
[FilesystemPaths]
Directories (e.g., /boot/efi, /boot/grub) monitored for unauthorized modification.
AN0776
Analytic 0776
macOS
Abnormal modification of EFI firmware binaries in /System/Library/CoreServices/ or NVRAM parameters not associated with OS updates. Unified logs capturing calls to bless or nvram commands executed from untrusted parent processes. Sudden unsigned kext loads after EFI variable tampering.
macos:unifiedlog
Execution of bless or nvram modifying boot parameters
macos:unifiedlog
Modification of /System/Library/CoreServices/boot.efi
[AllowedBootUtilities]
Known Apple-signed processes responsible for firmware updates.
[BootParamBaseline]
Baseline set of allowed NVRAM boot parameters for anomaly detection.
AN0777
Analytic 0777
Network Devices
Unexpected firmware image uploads via TFTP/FTP/SCP. Configuration changes modifying boot image pointers. Logs showing boot variable redirection to non-standard images. Anomalous reboots immediately following firmware changes not tied to patch schedules.
networkdevice:config
Boot variable modified to point to non-standard or unsigned image
networkdevice:firmware
Unexpected firmware image upload events via TFTP/FTP/SCP
[ApprovedFirmwareHashes]
Known good firmware image hashes allowed for boot.
[MaintenanceWindows]
Timeframes during which firmware updates are expected.