analyzing-uefi-bootkit-persistence - Analyze UEFI bootkit persistence and boot-chain integrity
Analyzes UEFI firmware, ESP contents, Secure Boot settings, UEFI variables, and boot-chain artifacts for bootkit persistence.
Tags
Updated: 2026-09-29Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Dump SPI flash firmware
- Inspect UEFI variables
- Examine ESP files
- Scan firmware signatures
- Detect Secure Boot bypasses
- Verify boot-chain integrity
- Document analysis findings
Inputs
- SPI flash firmware dump
- UEFI variable data
- EFI System Partition
- Firmware vendor baseline
- Memory dump
- UEFI malware rules
- Boot configuration data
Outputs
- Firmware analysis findings
- UEFI variable anomaly report
- ESP file inventory
- Bootkit detection results
- Boot-chain integrity results
- Remediation recommendations
Requirements
- chipsec framework
- UEFITool or UEFIExtract
- Python 3.8 or later
- Bootable Linux live USB
- Volatility 3
- YARA with UEFI rules
- Vendor firmware baselines
- Offline analysis access