Firmware Corruption T1495

Tactic: Impact

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system. Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType1eq 1, ne 1deletion, end, start
TargetFilename1wildcard 1\device\harddiskvolume*\efi\*
file.size1gt 10

Top indicator values (5 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
end
118
EventTypeeq
start
1391
EventTypene
deletion
186
TargetFilenamewildcard
\device\harddiskvolume*\efi\*
1
file.sizegt
0
13

Exclusions (64 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Hasheseq
07abbd7cd2693bc7b99c030ca86767d14e89a4c834cf9b5ae40ccf322ca81280
1
Hasheseq
0d0f9f92a8117090d710f28bd26753d4127a1b241b42fb0cc3688bc70a073965
1
Hasheseq
0def9f7030a3f2b8a3e13cc755df45179237353018f2742b91193a3b0a488656
1
Hasheseq
4342faa5ba84fd6a2142f7d3797cf301b6d73894ab49138eb83497498c06910c
1
Hasheseq
4ab2db239193ff9578bcc781779b0d43a3aa5262bb217699009f4190cab216a7
1
Hasheseq
7519024820f8575d20cf2c14e573ba48049dc5766e3d5714c5f7a6c790c505a3
1
Hasheseq
8c128cfd25a5d3c5b1f47da3f4d4964144af22b9fc76ffe7c67c1f5d0817b5ee
1
Hasheseq
8d39e6e50c2ef7aa7a62c3b57ee30a6a3e751ec1e288415f7a9b729126e10bc7
1
Hasheseq
a62316c113c92f88a042cf84ed589f8eab1ec9de99e3e2da65ad982a9653103e
1
Hasheseq
a6f0f7ceae685165ac142231215d8c1ee196d61723e26597b3eed65931f2296d
1
Hasheseq
c4207f4d040a7588a45e76aef8e1cc9d8499e35f199a31c838ee4867a6d25870
1
Hasheseq
dadf1bfc7471d3c51a9a8f57f791b44785947324496711f54ba42257559b6fdb
1
Hasheseq
e9373fdb8824e4431aba0c1df68ccc6ae098dab635f3504f7ee6efdfd97462da
1
Hasheseq
ee2317208b909c46b7c73b74f07f5be68717dc704398ec3434e8ba353e2cdd04
1
Hasheseq
eee7c0e92277ada0e4d57a0a2ef30f102bf6b311ba0a891f3db28fa0d5ee8f56
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 1 rule

Elastic 1 rule