{"description": "Enterprise techniques mitigated by Boot Integrity, ATT&CK mitigation M1046 (v1.1)", "name": "Boot Integrity (M1046)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "19", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1495", "comment": "Check the integrity of the existing BIOS and device firmware to determine if it is vulnerable to modification.", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1601", "comment": "Some vendors of embedded network devices provide cryptographic signing to ensure the integrity of operating system images at boot time.  Implement where available, following vendor guidelines. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1601.001", "comment": "Some vendors of embedded network devices provide cryptographic signing to ensure the integrity of operating system images at boot time.  Implement where available, following vendor guidelines. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1601.002", "comment": "Some vendors of embedded network devices provide cryptographic signing to ensure the integrity of operating system images at boot time.  Implement where available, following vendor guidelines. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1542", "comment": "Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. (Citation: TCG Trusted Platform Module) (Citation: TechNet Secure Boot Process)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1542.001", "comment": "Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology. (Citation: TCG Trusted Platform Module) Move system's root of trust to hardware to prevent tampering with the SPI flash memory.(Citation: ESET LoJax Sept 2018) Technologies such as Intel Boot Guard can assist with this. (Citation: Intel Hardware-based Security Technologies)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1542.003", "comment": "Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised.(Citation: TCG Trusted Platform Module)(Citation: TechNet Secure Boot Process)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1542.004", "comment": "Enable secure boot features to validate the digital signature of the boot environment and system image using a special purpose hardware device. If the validation check fails, the device will fail to boot preventing loading of unauthorized software. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1542.005", "comment": "Enable secure boot features to validate the digital signature of the boot environment and system image using a special purpose hardware device. If the validation check fails, the device will fail to boot preventing loading of unauthorized software. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505", "comment": "Enabling secure boot allows validation of software and drivers during initial system boot.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505.006", "comment": "Enabling secure boot allows ESXi to validate software and drivers during initial system boot.(Citation: Google Cloud Threat Intelligence ESXi Hardening 2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1553", "showSubtechniques": true}, {"techniqueID": "T1553.006", "comment": "Use of Secure Boot may prevent some implementations of modification to code signing policies.(Citation: Microsoft TESTSIGNING Feb 2021)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1195", "comment": "Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1195.003", "comment": "Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. (Citation: TCG Trusted Platform Module) (Citation: TechNet Secure Boot Process)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "mitigated by Boot Integrity", "color": "#66b1ff"}]}