dissecting-boot-and-kernel-rootkits

Name: dissecting-boot-and-kernel-rootkits
Author: meltedinhex

18stars5forks

How to install dissecting-boot-and-kernel-rootkits?

meltedinhex/analyst-ai-pack/dissecting-boot-and-kernel-rootkits

$npx -y skills add meltedinhex/analyst-ai-pack --skill dissecting-boot-and-kernel-rootkits

Installs into the current project.

Summary

Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/

Files · 1

View on GitHub

SKILL.md

1	# Dissecting Boot and Kernel Rootkits
2
3	## When to Use
4
5	- You have a sample (MBR/VBR image, UEFI module, or kernel driver) suspected of boot-process or
6	kernel-level tampering and stealth.
7	- You need to identify the persistence vector and stealth technique class statically.
8
9	Do not use this on production firmware/boot media without acquisition — analyze a captured
10	image. The skill reads bytes statically and executes nothing.
11
12	## Prerequisites
13
14	- The boot image / UEFI module / driver (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; never write the sample to boot media or load the driver.
19
20	## Workflow
21
22	### Step 1: Classify the artifact
23
24	```bash
25	python scripts/analyst.py classify sample.bin
26	```
27
28	Detects MBR/VBR (boot signature `0x55AA` at 0x1FE), UEFI modules (PE with `EFI` subsystem / PI
29	GUIDs / `EFI_` strings), and kernel drivers (PE importing `ntoskrnl`/`hal`, `.sys` indicators).
30
31	### Step 2: Identify tampering / hooking indicators
32
33	Flag disk-write primitives (`Int 13h` for MBR bootkits), SSDT/IRP hooking and `Zw`/`Ke` kernel
34	APIs, DKOM strings, and driver-callback registration.
35
36	### Step 3: Map the persistence vector
37
38	Determine whether persistence is via MBR/VBR overwrite, UEFI variable/module, or driver service.
39
40	### Step 4: Document
41
42	Record the artifact type, persistence vector, and stealth technique class, mapping to ATT&CK.
43
44	## Validation
45
46	- The artifact type is identified by concrete signatures (boot signature, PE subsystem, imports).
47	- Tampering/hooking indicators reference real primitives, not generic strings.
48	- The persistence vector is stated with its evidence.
49
50	## Pitfalls
51
52	- A legitimate bootloader/driver resembling a bootkit/rootkit — corroborate with behavior.
53	- UEFI modules requiring firmware-volume parsing beyond simple PE checks.
54	- Kernel samples needing signed-driver and callback context to confirm stealth.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the classifier.
59	- ATT&CK T1542.003 and T1014 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

dissecting-boot-and-kernel-rootkits

18stars5forks

View on GitHub

How to install dissecting-boot-and-kernel-rootkits?

meltedinhex/analyst-ai-pack/dissecting-boot-and-kernel-rootkits

$npx -y skills add meltedinhex/analyst-ai-pack --skill dissecting-boot-and-kernel-rootkits

Installs into the current project.

Summary

Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/

Files · 1

View on GitHub

SKILL.md

1	# Dissecting Boot and Kernel Rootkits
2
3	## When to Use
4
5	- You have a sample (MBR/VBR image, UEFI module, or kernel driver) suspected of boot-process or
6	kernel-level tampering and stealth.
7	- You need to identify the persistence vector and stealth technique class statically.
8
9	Do not use this on production firmware/boot media without acquisition — analyze a captured
10	image. The skill reads bytes statically and executes nothing.
11
12	## Prerequisites
13
14	- The boot image / UEFI module / driver (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; never write the sample to boot media or load the driver.
19
20	## Workflow
21
22	### Step 1: Classify the artifact
23
24	```bash
25	python scripts/analyst.py classify sample.bin
26	```
27
28	Detects MBR/VBR (boot signature `0x55AA` at 0x1FE), UEFI modules (PE with `EFI` subsystem / PI
29	GUIDs / `EFI_` strings), and kernel drivers (PE importing `ntoskrnl`/`hal`, `.sys` indicators).
30
31	### Step 2: Identify tampering / hooking indicators
32
33	Flag disk-write primitives (`Int 13h` for MBR bootkits), SSDT/IRP hooking and `Zw`/`Ke` kernel
34	APIs, DKOM strings, and driver-callback registration.
35
36	### Step 3: Map the persistence vector
37
38	Determine whether persistence is via MBR/VBR overwrite, UEFI variable/module, or driver service.
39
40	### Step 4: Document
41
42	Record the artifact type, persistence vector, and stealth technique class, mapping to ATT&CK.
43
44	## Validation
45
46	- The artifact type is identified by concrete signatures (boot signature, PE subsystem, imports).
47	- Tampering/hooking indicators reference real primitives, not generic strings.
48	- The persistence vector is stated with its evidence.
49
50	## Pitfalls
51
52	- A legitimate bootloader/driver resembling a bootkit/rootkit — corroborate with behavior.
53	- UEFI modules requiring firmware-volume parsing beyond simple PE checks.
54	- Kernel samples needing signed-driver and callback context to confirm stealth.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the classifier.
59	- ATT&CK T1542.003 and T1014 (linked in frontmatter).

People who liked this also viewed

6 picks

Type