ATT&CK technique
View on MITRE ATT&CK →
T1542
Pre-OS Boot
StealthPersistence
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | GRUB Configuration Generation through Built-in Utilities | production | 2026-10-09 |
| splunk | Windows Registry BootExecute Modification | production | 2026-10-02 |
| elastic | Dracut Module Creation | production | 2026-09-18 |
| elastic | Initramfs Extraction via CPIO | production | 2026-09-18 |
| elastic | Manual Dracut Execution | production | 2026-09-18 |
| elastic | Initramfs Unpacking via unmkinitramfs | production | 2026-09-18 |
| elastic | GRUB Configuration File Creation | production | 2026-09-18 |
| elastic | Boot File Copy | production | 2026-09-18 |
| splunk | Windows EFI Volume Mount Attempt Via Mountvol | production | 2026-05-13 |