flowchart TB
A[Bootkit Malware]:::root
A --> G["Primary objective:<br/>execute before the operating system and retain persistence"]:::goal
G --> L[Targeted boot layer]:::cat
G --> M[Conceptual modification methods]:::cat
G --> C[Boot-chain control]:::cat
G --> E[Evasion and concealment]:::cat
L --> L1[Legacy BIOS and MBR]
L --> L2[Partition VBR or boot sector]
L --> L3[Bootloader or boot manager]
L --> L4[UEFI EFI System Partition]
L --> L5[UEFI system firmware]
L --> L6[Recovery or early-boot environment]
M --> M1[Boot-record replacement or patching]
M --> M2[Bootloader replacement or redirection]
M --> M3[Creation or modification of EFI applications]
M --> M4[Boot configuration or entry manipulation]
M --> M5[Early-boot component modification]
M --> M6[Firmware-region modification]
C --> C1[Execute before OS security initializes]
C --> C2[Load a concealed next-stage component]
C --> C3[Influence kernel or boot-driver loading]
C --> C4[Transfer control to the normal OS afterward]
C --> C5[Re-establish components during each boot]
E --> E1[Hide within boot partitions or reserved sectors]
E --> E2[Masquerade as legitimate boot components]
E --> E3[Reduce visibility to OS-level security tools]
E --> E4[Manipulate or evade integrity expectations]
E --> E5[Use layered boot and post-boot components]
L1 & L2 & L3 & L4 & L5 & L6 --> X[Pre-OS malicious execution]:::impact
M1 & M2 & M3 & M4 & M5 & M6 --> X
C1 & C2 & C3 & C4 & C5 --> X
E1 & E2 & E3 & E4 & E5 --> X
X --> O[Operational effects]:::effect
O --> O1[Persistence below the operating system]
O --> O2[Early privileged influence over startup]
O --> O3[Possible survival of ordinary OS remediation]
O --> O4[Reduced trust in local security reporting]
O --> O5[Potential destructive boot interference]
O --> D[Defensive observables]:::detect
D --> D1[Unexpected MBR or VBR content changes]
D --> D2[New or altered files in the EFI System Partition]
D --> D3[Boot-order, boot-entry or NVRAM anomalies]
D --> D4[Secure Boot, measured-boot or attestation failures]
D --> D5[Raw physical-drive or block-device writes]
D --> D6[Unexpected bootloader, kernel, initrd or driver changes]
D --> D7[Boot-stage network or memory behavior without OS attribution]
D --> F[Recommended defensive analysis]:::defense
F --> F1[Compare boot records and ESP files with trusted baselines]
F --> F2[Validate Secure Boot and measured-boot evidence]
F --> F3[Acquire disk, ESP and firmware evidence offline]
F --> F4[Inspect boot configuration and firmware variables]
F --> F5[Correlate raw-disk writes with privileged processes]
F --> F6[Rebuild the boot chain and reflash trusted firmware when required]
click A "https://attack.mitre.org/techniques/T1542/003/" "MITRE ATT&CK T1542.003 Bootkit" _blank
click L5 "https://attack.mitre.org/techniques/T1542/001/" "MITRE ATT&CK T1542.001 System Firmware" _blank
click D4 "https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process" "Microsoft boot security guidance" _blank
classDef root fill:#7f1d1d,color:#fff,stroke:#450a0a,stroke-width:3px;
classDef goal fill:#fff7ed,color:#7c2d12,stroke:#f97316,stroke-width:2px;
classDef cat fill:#1e3a8a,color:#fff,stroke:#172554,stroke-width:2px;
classDef impact fill:#6b21a8,color:#fff,stroke:#3b0764,stroke-width:2px;
classDef effect fill:#334155,color:#fff,stroke:#0f172a,stroke-width:2px;
classDef detect fill:#9a3412,color:#fff,stroke:#431407,stroke-width:2px;
classDef defense fill:#166534,color:#fff,stroke:#052e16,stroke-width:2px;
Awesome Bootkit Malware 
You can access the my other awesome lists here
Contributions of any kind welcome, just follow the guidelines!
Thanks goes to these contributors!
