T1542 — Pre-OS Boot

# T1542 - Pre-OS Boot

## SOC Recommendation
Investigate Pre-OS Boot activity in the context of Stealth/Persistence: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Firmware Embedded Monitoring Code | Detect | Monitor for Firmware Embedded Monitoring Code indicators relevant to this technique. |
| Software Update | Harden | Apply Software Update to reduce this technique's viability before an incident occurs. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |
| Restore Software | Restore | Use Restore Software to recover affected systems or data after containment. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType has "<tune to T1542>"
```

## Escalation Criteria
- Pre-OS Boot activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1542.json
• /api/recommendations/T1542.json
• /api/d3fend/T1542.json
• /api/mappings/T1542.json
• /api/confluence/T1542.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1542.json

Response:

{
  "technique_id": "T1542",
  "name": "Pre-OS Boot",
  "priority": "low",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Stealth",
    "Persistence"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Network Devices",
    "Windows"
  ],
  "summary": "Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control...",
  "soc_recommendation": "Investigate Pre-OS Boot activity in the context of Stealth/Persistence: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FEMC",
      "name": "Firmware Embedded Monitoring Code",
      "relationship": "detect",
      "practical_action": "Monitor for Firmware Embedded Monitoring Code indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-SU",
      "name": "Software Update",
      "relationship": "harden",
      "practical_action": "Apply Software Update to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-NTF",
      "name": "Network Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-RS",
      "name": "Restore Software",
      "relationship": "restore",
      "practical_action": "Use Restore Software to recover affected systems or data after containment.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed pre-os boot activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Boot File Copy\" -- This rule detects the process of copying or moving files from or to the \"/boot\" directory on Linux systems. The \"/boot\" directory contains files that are essential for the system to boot, such as the kernel and initramfs images. Attackers may copy or move files to the \"/boot\" directory to modify the boot process, which can be leveraged to maintain access to the system."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "Starting point for T1542",
        "description": "Generic starting query -- tune to the specific data source relevant to this technique.",
        "query": "DeviceEvents\n| where TimeGenerated > ago(24h)\n| where ActionType has \"<tune to T1542>\""
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "5bda8597-69a6-4b9e-87a2-69a7c963ea83 — Boot File Copy",
        "description": "(EQL) This rule detects the process of copying or moving files from or to the \"/boot\" directory on Linux systems. The \"/boot\" directory contains files that are essential for the system to boot, such as the kernel and initramfs images. Attackers may copy or move files to the \"/boot\" directory to modify the boot process, which can be leveraged to maintain access to the system. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"exec\", \"start\") and\nprocess.name in (\"cp\", \"mv\") and process.parent.executable != null and process.args like~ \"/boot/*\" and not (\n  process.parent.name in (\"update-initramfs\", \"dracut\", \"grub-mkconfig\", \"shim-install\", \"sudo\", \"activate-theme\", \"update-grub-gfxpayload\", \"grub-pc.postinst\") or\n  process.parent.executable like~ (\"/usr/lib/kernel/install.d/*\", \"/tmp/newroot/*\", \"/var/lib/dpkg/info/*\") or\n  process.parent.args like~ (\"/usr/bin/mkinitcpio\", \"/var/tmp/rpm-tmp.*\", \"/var/lib/dpkg/info/*\") or\n  process.parent.executable in (\n    \"/var/lib/aws-replication-agent/migration_scripts/suse_to_aws.bash\", \"/usr/sbin/flash-kernel\", \"/usr/sbin/weak-modules\",\n    \"/etc/cron.hourly/check_mau\", \"/usr/bin/update-microcode-initrd\", \"/bin/run-parts\", \"/usr/sbin/mkinitramfs\", \"/usr/sbin/grub2-mkconfig\",\n    \"/usr/bin/supermin5\", \"/sbin/weak-modules\", \"/usr/sbin/nv-update-initrd\", \"/usr/libexec/platform-python\", \"/bin/kernel-install\",\n    \"/usr/bin/oracle-database-preinstall-19c-verify\", \"/usr/libexec/grubby/prune_debug\"\n  ) or\n  process.command_line == \"/bin/cp /usr/local/ASR/Vx/scripts/vCon//Configuration.info /boot/\" or\n  ?process.working_directory in (\"/var/lib/aws-replication-agent\", \"/opt/sentinelone/bin\", \"/tmp/MobilityAgentAutoUpgrade/package\") or\n  (\n    process.name == \"cp\" and\n    process.parent.args in (\n      \"/etc/kernel/postrm.d/zz-proxmox-boot\", \"/etc/kernel/postinst.d/zz-proxmox-boot\", \"/usr/lib/kernel/install.d/20-grub.install\",\n      \"/usr/bin/dracut\", \"/bin/dracut\", \"/usr/sbin/shim-install\", \"/sbin/dracut\", \"/opt/McAfee/ens/esp/scripts/modversion-check.sh\",\n      \"//opt/McAfee/ens/esp/scripts//modversion-check.sh\", \"/usr/sbin/update-grub-legacy-ec2\", \"/usr/bin/foreman-generate-bootloaders\",\n      \"/usr/share/grub2/themes/SLE/activate-theme\", \"/usr/sbin/dracut\", \"/usr/sbin/flash-kernel\", \"/usr/lib/kernel/install.d/20-grubby.install\"\n    ) \n  ) or\n  (process.name == \"mv\" and process.args == \"-f\" and process.parent.args == \"/usr/sbin/update-initramfs\") or\n  (\n    process.name == \"mv\" and\n    process.parent.args in (\n      \"/usr/sbin/flash-kernel\", \"/usr/bin/update-microcode-initrd\", \"/usr/sbin/update-grub-gfxpayload\",\n      \"/usr/sbin/weak-modules\", \"/usr/bin/dracut\"\n    )\n  )\n)"
      },
      {
        "name": "dc765fb2-0c99-4e57-8c11-dafdf1992b66 — Dracut Module Creation",
        "description": "(EQL) This rule detects the creation of Dracut module files on Linux systems. Dracut is a tool used to generate an initramfs image that is used to boot the system. Dracut modules are scripts that are executed during the initramfs image generation process... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "file where host.os.type == \"linux\" and event.type == \"creation\" and process.executable != null and\nfile.path like~ (\"/lib/dracut/modules.d/*\", \"/usr/lib/dracut/modules.d/*\") and not (\n  // Too many FPs from Python automation\n  process.name like (\"python*\", \"platform-python*\") or\n  process.executable in (\n    \"/bin/dpkg\", \"/usr/bin/dpkg\", \"/bin/dockerd\", \"/usr/bin/dockerd\", \"/usr/sbin/dockerd\", \"/bin/microdnf\",\n    \"/usr/bin/microdnf\", \"/bin/rpm\", \"/usr/bin/rpm\", \"/bin/snapd\", \"/usr/bin/snapd\", \"/bin/yum\", \"/usr/bin/yum\",\n    \"/bin/dnf\", \"/usr/bin/dnf\", \"/bin/podman\", \"/usr/bin/podman\", \"/bin/dnf-automatic\", \"/usr/bin/dnf-automatic\",\n    \"/bin/pacman\", \"/usr/bin/pacman\", \"/usr/bin/dpkg-divert\", \"/bin/dpkg-divert\", \"/sbin/apk\", \"/usr/sbin/apk\",\n    \"/usr/local/sbin/apk\", \"/usr/bin/apt\", \"/usr/sbin/pacman\", \"/bin/podman\", \"/usr/bin/podman\", \"/usr/bin/puppet\",\n    \"/bin/puppet\", \"/opt/puppetlabs/puppet/bin/puppet\", \"/usr/bin/chef-client\", \"/bin/chef-client\",\n    \"/bin/autossl_check\", \"/usr/bin/autossl_check\", \"/proc/self/exe\", \"/usr/bin/pamac-daemon\",\n    \"/bin/pamac-daemon\", \"/usr/lib/snapd/snapd\", \"/usr/local/bin/dockerd\", \"/usr/bin/crio\", \"/usr/sbin/crond\",\n    \"/opt/puppetlabs/puppet/bin/ruby\", \"/usr/libexec/platform-python\", \"/kaniko/kaniko-executor\",\n    \"/usr/local/bin/dockerd\", \"/usr/bin/podman\", \"/bin/install\", \"/proc/self/exe\", \"/usr/lib/systemd/systemd\",\n    \"/usr/sbin/sshd\", \"/usr/bin/gitlab-runner\", \"/opt/gitlab/embedded/bin/ruby\", \"/usr/sbin/gdm\", \"/usr/bin/install\",\n    \"/usr/local/manageengine/uems_agent/bin/dcregister\", \"/usr/local/bin/pacman\", \"/usr/libexec/packagekitd\",\n    \"./usr/bin/podman\", \"/usr/lib/dracut/dracut-install\", \"/usr/bin/dnf5\", \"/kaniko/executor\", \"/usr/bin/buildah\",\n    \"/usr/sbin/yum-cron\"\n  ) or\n  process.executable like~ (\n    \"/nix/store/*\", \"/var/lib/dpkg/*\", \"/tmp/vmis.*\", \"/snap/*\", \"/dev/fd/*\", \"/usr/lib/virtualbox/*\",\n    \"/var/lib/docker/overlay2/*/dockerd\"\n  ) or\n  file.extension in (\"swp\", \"swpx\", \"swx\", \"dpkg-remove\") or\n  (process.name == \"sed\" and file.name : \"sed*\")\n)"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Pre-OS Boot activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1542 - Pre-OS Boot Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}