Menu

Individual skill

hunting-bootkits-in-efi-system-partition

0upvotes

Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall.

skills/hunting-bootkits-in-efi-system-partition/SKILL.md

Read pinned source

Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
35,882
Repository last updated
Aug 31, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt
# Hunting Bootkits in the EFI System Partition

## Overview

The EFI System Partition (ESP) is a small FAT32-formatted partition that the platform firmware reads at power-on to locate and execute the operating system's boot loader. Because it executes *before* the operating system, kernel, and any EDR agent, the ESP is one of the most coveted persistence locations for advanced adversaries. UEFI bootkits that live on the ESP survive OS reinstallation, disk reformatting of the OS partition, and most endpoint defenses.

This skill follows the detection research published by **Eclypsium** ("Enhanced Threat Detection: Bootloaders, Bootkits, and Secure Boot", and the *Bootkitty* and *Glupteba* analyses) and aligns with the ESP-hunting methodology Rapid7 documented for Velociraptor (`Windows.Forensics.UEFI`, `Windows.Detection.Yara.UEFI`). The threat context is concrete and current:

- **ESPecter** (ESET, 2021) — a UEFI bootkit that persists on the ESP as a patched Windows Boot Manager (`bootmgfw.efi`) plus malicious kernel-mode drivers. It marked the move of UEFI threats *from SPI flash to the ESP*, where they are far easier to deploy.
- **BlackLotus** (2023) — the first in-the-wild UEFI bootkit able to bypass Secure Boot on fully patched Windows 11 by exploiting CVE-2022-21894 ("baton drop") and staging a vulnerable signed `bootmgfw.efi` on the ESP.
- **Bootkitty** (2024) — the first UEFI bootkit targeting Linux, dropped onto the ESP.
- **Glupteba** — commodity malware whose UEFI variant replaces software on the EFI partition.

The core detection insight from Eclypsium and Rapid7 is that the bootloader normally changes **only** during a vendor or OS update; an out-of-band change to ESP binaries, an unsigned or untrusted-signed boot loader, or any file in the ESP root that is *not* under the `EFI/` directory is a high-fidelity indicator of compromise. This skill builds that baseline and hunts deviations from it.
Back to top