Techniques › T1542 › AN0775
AN0775 Analytic 0775
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of writes to /boot or EFI directories outside of expected package manager updates. Monitoring kernel log and auditd events for attempts to overwrite bootloader binaries (e.g., grub, shim). Unexpected execution of efibootmgr or dd writing to /dev/sdX devices followed by boot parameter changes.</p>
- Detects
- T1542 Pre-OS Boot
- Part of
- DET0278 Detection Strategy for T1542 Pre-OS Boot
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open, write: Modification of /boot/grub/* or /boot/efi/* | DC0061 File Modification |
| auditd:EXECVE | exec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PackageManagerUpdateWhitelist | Allowlist of legitimate grub/shim updates via apt, yum, or rpm. |
FilesystemPaths | Directories (e.g., /boot/efi, /boot/grub) monitored for unauthorized modification. |