MITRE ATT&CK T1542: Pre-OS Boot (Enterprise Tactic TA0005 - Defense Evasion / TA0003 - Persistence)

What MITRE ATT&CK T1542: Pre-OS Boot (Enterprise Tactic TA0005 - Defense Evasion / TA0003 - Persistence) requires

MITRE ATT&CK T1542 (Pre-OS Boot) is an Enterprise Defense Evasion and Persistence technique. Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control. Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. ATT&CK documents 5 sub-techniques: T1542.001 System Firmware; T1542.002 Component Firmware; T1542.003 Bootkit; T1542.004 ROMMONkit; T1542.005 TFTP Boot. Affected platforms: Linux, Windows, Network, macOS. MITRE-documented mitigations include M1035 Limit Access to Resource Over Network, M1047 Audit, M1051 Update Software, M1026 Privileged Account Management, M1046 Boot Integrity. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, CM-02, CM-03, CM-05, CM-06.

Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated: 2026-05-25

Primary source: https://attack.mitre.org/techniques/T1542/

SHA-256 integrity: 7826fdbdfdd6e028e601b1b548310c52b8aabeca1a09da2af0452cdc6fe28423

Primary Citations — 7 traced to source

• MITRE ATT&CK Technique T1542: Pre-OS Boot (https://attack.mitre.org/techniques/T1542/) with 5 sub-techniques
• MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)

+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/mitre-attack-t1542-pre-os-boot.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/mitre-attack-t1542-pre-os-boot.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/mitre-attack-t1542-pre-os-boot
• Back to registry: Browse all 10,085 compliance nodes