Techniques › T1542.003 › AN0429
AN0429 Analytic 0429
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of suspicious write operations to block devices, modifications of bootloader files (GRUB, initrd, vmlinuz), and unexpected changes within the EFI System Partition. Monitors privileged execution of utilities like dd, grub-install, or efibootmgr that modify boot sectors or loader entries.</p>
- Detects
- T1542.003 Bootkit
- Part of
- DET0150 Detection Strategy for File Creation or Modification of Boot Files
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open, write: Write operations targeting /dev/sda, /dev/nvme0n1, or EFI partition mounts | DC0061 File Modification |
| linux:syslog | Block device write errors or unusual bootloader activity | DC0046 Drive Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BootloaderHashBaseline | Baseline checksums of GRUB, kernel, and initramfs images |
EFIFileAllowlist | Trusted EFI executables for Linux environments |
AlertThresholds | Tunable thresholds for triggering alerts on repeated EFI/bootloader writes |