SOC analyst playbook for detecting and responding to boot-level and firmware persistence including MBR overwrites, UEFI implants, bcdedit BCD manipulation, and Secure Boot bypass. DeviceEvents MbrWrite, DeviceProcessEvents bcdedit.exe. KQL for Sentinel, SPL for Splunk.
This is member content. See membership options to read it in full.