Individual skill
analyzing-uefi-bootkit-persistence
Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.
internal/tools/skills/data/firmware-security/analyzing-uefi-bootkit-persistence/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,325
- Repository last updated
- Nov 9, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- uefi Declared skill tag
- bootkit Declared skill tag
- firmware Declared skill tag
- secure-boot Declared skill tag
- chipsec Declared skill tag
- esp Declared skill tag
- persistence Declared skill tag
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytesSKILL.mdcore · 16,407 bytes
Read excerpt
# Analyzing UEFI Bootkit Persistence
## When to Use
- A compromised system re-establishes C2 communication after OS reinstallation or disk replacement
- Secure Boot has been tampered with, disabled, or shows unexpected Machine Owner Key (MOK) enrollment
- Firmware integrity verification fails against vendor-provided baselines
- Memory forensics reveals rootkit components loading during early boot phase
- Investigating advanced persistent threat (APT) campaigns known to deploy UEFI implants
- Auditing firmware security posture for enterprise endpoint hardening
**Do not use** for standard MBR-based bootkits on legacy BIOS systems without UEFI; use MBR/VBR bootkit analysis instead.
## Detection Gaps & Validation