Persistence via Extensible Firmware Modification

[rule]
description = """
Identifies the modification of the Extensible Firmware Interface (EFI) files. Advanced adversaries may abuse Pre-OS Boot
mechanisms as a way to establish persistence in a system.
"""
id = "22fbd47a-8c72-4117-9355-f07fdcd9c0f4"
license = "Elastic License v2"
name = "Persistence via Extensible Firmware Modification"
os_list = ["windows"]
reference = [
    "https://github.com/Cr4sh/s6_pcie_microblaze/blob/master/python/payloads/DmaBackdoorHv/bootkit_installer.ps1",
    "https://securelist.com/finspy-unseen-findings/104322/",
]
version = "1.0.32"

query = '''
sequence by process.entity_id
 [process where event.action == "start" and
  not (process.pe.original_file_name :
         ("SetupHost.exe", "wbengine.exe", "BitLockerWizardElev.exe", "BitLockerDeviceEncryption.exe",
          "omadmclient.exe", "TSManager.exe", "SETUPPLATFORM.EXE", "RECOVERYDRIVE.EXE") and process.code_signature.subject_name like "Microsoft *" and
          process.code_signature.trusted == true) and

  not process.hash.sha256 : 
             ("07abbd7cd2693bc7b99c030ca86767d14e89a4c834cf9b5ae40ccf322ca81280", 
              "eee7c0e92277ada0e4d57a0a2ef30f102bf6b311ba0a891f3db28fa0d5ee8f56", 
              "ffac39846b01ad8d9b1074108ace1e148b8d1805b7790e15fe8975f1a4dac5df", 
              "e9373fdb8824e4431aba0c1df68ccc6ae098dab635f3504f7ee6efdfd97462da",
              "c4207f4d040a7588a45e76aef8e1cc9d8499e35f199a31c838ee4867a6d25870",
              "4ab2db239193ff9578bcc781779b0d43a3aa5262bb217699009f4190cab216a7",
              "0d0f9f92a8117090d710f28bd26753d4127a1b241b42fb0cc3688bc70a073965",
              "7519024820f8575d20cf2c14e573ba48049dc5766e3d5714c5f7a6c790c505a3",
              "4ab2db239193ff9578bcc781779b0d43a3aa5262bb217699009f4190cab216a7",
              "4342faa5ba84fd6a2142f7d3797cf301b6d73894ab49138eb83497498c06910c",
              "8c128cfd25a5d3c5b1f47da3f4d4964144af22b9fc76ffe7c67c1f5d0817b5ee",
              "a6f0f7ceae685165ac142231215d8c1ee196d61723e26597b3eed65931f2296d", 
              "ee2317208b909c46b7c73b74f07f5be68717dc704398ec3434e8ba353e2cdd04", 
              "a62316c113c92f88a042cf84ed589f8eab1ec9de99e3e2da65ad982a9653103e", 
              "0def9f7030a3f2b8a3e13cc755df45179237353018f2742b91193a3b0a488656", 
              "dadf1bfc7471d3c51a9a8f57f791b44785947324496711f54ba42257559b6fdb",
              "4ab2db239193ff9578bcc781779b0d43a3aa5262bb217699009f4190cab216a7",
              "dadf1bfc7471d3c51a9a8f57f791b44785947324496711f54ba42257559b6fdb",
              "8d39e6e50c2ef7aa7a62c3b57ee30a6a3e751ec1e288415f7a9b729126e10bc7") and

  not (process.executable : "?:\\Windows\\System32\\bcdedit.exe" and process.args : "/export") and 
  
  not process.parent.executable :
           ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
            "?:\\Program Files (x86)\\ISO to USB\\isotousb.exe", 
            "?:\\Program Files (x86)\\baramundi\\BMA\\BDSRun.exe", 
            "?:\\Program Files (x86)\\Dell\\UpdateService\\ServiceShell.exe", 
            "?:\\Program Files (x86)\\OmniBack\\bin\\vbda.exe") and
  
  not (process.executable : "?:\\Windows\\HP\\Installer.exe" and process.args : "-bestsize" and process.args : "-uefisupport") and 

  not (process.code_signature.subject_name :
           ("Akeo Consulting", "HP Inc.", "Dell Inc", "Dell Technologies Inc.", "Veritas Technologies LLC", "Insyde Software Corp.", "Huawei Technologies Co., Ltd.", "FUJITSU CLIENT COMPUTING LIMITED", "Micro Focus Group Limited", "ESET, spol. s r.o.") and
       process.code_signature.trusted == true) and

  not (process.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.args : "BDESVC" and process.parent.name : "services.exe") and

  not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/sysrepair" and process.parent.name : "svchost.exe") and

  not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/f" and process.args : "?:\\Windows") and

  not (process.executable : ("?:\\Windows\\System32\\taskhostw.exe", "?:\\Windows\\System32\\AggregatorHost.exe", "?:\\Windows\\UUS\\amd64\\wuaucltcore.exe") and process.parent.executable : "?:\\Windows\\System32\\svchost.exe")
  ]
 [file where event.action != "deletion" and file.path :"\\Device\\HarddiskVolume*\\EFI\\*" and

  file.size > 0 and 

  not (process.name : ("powershell.exe", "wsmprovhost.exe") and file.path : ("\\Device\\HarddiskVolume*\\EFI\\HP\\DEVFW\\*", "\\Device\\HarddiskVolume*\\EFI\\Microsoft\\Boot\\SecConfig.efi")) and

  not (process.executable : "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe" and file.path : "\\Device\\HarddiskVolume*\\EFI\\*.log")]
 until [process where event.action == "end"]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1542"
name = "Pre-OS Boot"
reference = "https://attack.mitre.org/techniques/T1542/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1495"
name = "Firmware Corruption"
reference = "https://attack.mitre.org/techniques/T1495/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "8.4.0"