MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

add ESPecter Bootkit

pull/669/head
Delta-Sierra 2021-11-19 16:30:57 +01:00
parent c89623e945
commit 78a8cf4ad2
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
clusters/tool.json
View File

@ -8441,14 +8441,15 @@
"value": "BLUELIGHT"
},
{
"value": "ESPecter bootkit",
"description": "ESET researchers have analyzed a previously undocumented, real-world UEFI bootkit that persists on the EFI System Partition (ESP). The bootkit, which we’ve named ESPecter, can bypass Windows Driver Signature Enforcement to load its own unsigned driver, which facilitates its espionage activities. Alongside Kaspersky’s recent discovery of the unrelated FinSpy bootkit, it is now safe to say that real-world UEFI threats are no longer limited to SPI flash implants, as used by Lojax.",
"meta": {
"refs": [
"https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/",
"https://github.com/eset/malware-ioc/tree/master/especter"
]
}
},
"uuid": "d5b31712-a5b4-4b1c-9a74-4340abc61210",
"value": "ESPecter bootkit"
}
],
"version": 148