# UEFI Threat Reference

## UEFI Boot Process

```
SEC → PEI → DXE → BDS → OS Loader → OS Kernel
```

1. **SEC** (Security): CPU initialization, trust establishment
2. **PEI** (Pre-EFI Initialization): Memory initialization, hardware setup
3. **DXE** (Driver Execution Environment): Load DXE drivers, services
4. **BDS** (Boot Device Selection): Find and launch OS bootloader
5. **OS Loader**: Windows Boot Manager, GRUB, etc.

## Known UEFI Implants

### LoJax (2018) — APT28/Fancy Bear
- First in-the-wild UEFI rootkit
- Modified SPI flash to add malicious DXE driver
- Driver drops user-mode agent to disk on every boot
- Survives OS reinstallation and disk replacement

### MosaicRegressor (2020)
- Multi-component UEFI bootkit framework
- Modular design with multiple DXE driver implants
- Associated with Chinese-speaking threat actor
- Targets: diplomatic entities, NGOs

### FinSpy UEFI (2021)
- Commercial surveillance spyware
- Replaces Windows Boot Manager
- Injects surveillance payload before OS loads

### ESPecter (2021)
- Modifies EFI System Partition (ESP)
- Patches Windows Boot Manager on disk
- Bypasses Driver Signature Enforcement
- Active since at least 2012

### CosmicStrand (2022)
- Persists in UEFI firmware images on motherboard
- Found on Gigabyte and ASUS motherboards
- Creates kernel-level implant during boot

### BlackLotus (2023)
- First bootkit to bypass UEFI Secure Boot on updated systems
- Exploits CVE-2022-21894 (Baton Drop)
- Disables BitLocker, HVCI, Windows Defender
- Full bootkit functionality with kernel driver

## Detection Methods

1. **Firmware integrity verification**: Compare SPI flash dump against known-good
2. **Secure Boot validation**: Verify boot chain signatures
3. **CHIPSEC analysis**: Run CHIPSEC security tests
4. **Runtime monitoring**: Check for unexpected DXE services
5. **Memory forensics**: Detect boot-time injected code in OS memory