SOP-31: Boot / Firmware Persistence (Bootkit) Response

SOC analyst playbook for detecting and responding to boot-level and firmware persistence including MBR overwrites, UEFI implants, bcdedit BCD manipulation, and Secure Boot bypass. DeviceEvents MbrWrite, DeviceProcessEvents bcdedit.exe. KQL for Sentinel, SPL for Splunk.