Threat intelligence / Technique

Pre-OS Boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

10 recorded

Relationships

mitigates

from Audit

Mitigation

mitigates

from Boot Integrity

Mitigation

mitigates

from Limit Access to Resource Over Network

Mitigation

mitigates

from Privileged Account Management

Mitigation

mitigates

from Update Software

Mitigation

subtechnique-of

Technique

subtechnique-of

from Component Firmware

Technique

subtechnique-of

Technique

subtechnique-of

from System Firmware

Technique

subtechnique-of

Technique

2 external

References

mitre-attack

T1542

Wikipedia Booting

https://en.wikipedia.org/wiki/Booting