Menu

Individual skill

detecting-secure-boot-bypass

0upvotes

Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.

skills/detecting-secure-boot-bypass/SKILL.md

Read pinned source

Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
35,887
Repository last updated
Aug 31, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt
# Detecting Secure Boot Bypass

> **Legal Notice:** Firmware and Secure Boot assessment must only be performed on systems you own or are explicitly authorized to test. CHIPSEC's write/modify modes and EFI variable manipulation can brick hardware. Run destructive checks only in a lab. This skill is for defensive verification and authorized assessment.

## Overview

UEFI Secure Boot is the firmware-enforced trust chain that only permits boot components signed by keys in the platform's allow-list (db) and not present in the revocation list (dbx). Bootkits defeat this layer to gain pre-OS, persistent, kernel-level control that survives OS reinstalls and disk wipes. **BlackLotus** (2023) was the first publicly observed UEFI bootkit to bypass Secure Boot on fully patched Windows 11, abusing **CVE-2022-21894** ("baton drop") in a vulnerable, signed Windows boot manager to neutralize Secure Boot and disable BitLocker, HVCI, and Defender. **Bootkitty** (2024) was the first PoC UEFI bootkit targeting Linux. Microsoft's **CVE-2023-24932** addressed a related Secure Boot bypass that required a phased dbx (revocation) rollout because revoking the vulnerable boot managers can render systems unbootable if applied carelessly.

The core defensive insight is that patching the OS is **not sufficient** — the platform remains exploitable until the vulnerable, signed binaries are revoked in **dbx**. Detection therefore combines: (1) confirming Secure Boot is actually enabled, (2) verifying dbx is current and contains the relevant revocations, (3) checking the integrity and protection of Secure Boot EFI variables with CHIPSEC, (4) hashing on-disk EFI boot binaries and comparing them against the revocation list and known-bad sets, and (5) inspecting firmware/ESP for bootkit artifacts. This skill provides a cross-platform (Linux + Windows) workflow using `mokutil`, `efi-readvar`/`dbxtool`, `chipsec`, `sbverify`/`pesign`, and Windows `Confirm-SecureBootUEFI` / `Get-SecureBootUEFI`.

## When to Use

- Verifying that an estate's Secure Boot configuration is enabled, locked, and current after the CVE-2023-24932 / BlackLotus advisories.
- Hunting for UEFI bootkit indicators on a suspected-compromised endpoint.
- Validating that dbx revocations (e.g., vulnerable Windows boot managers, Kaspersky/other vulnerable bootloaders) have actually applied across the fleet.
Back to top