{
	"id": "46a06dc9-f2ee-46d9-86e6-f71317d56b91",
	"created_at": "2026-04-06T00:19:47.023848Z",
	"updated_at": "2026-04-10T03:20:40.536878Z",
	"deleted_at": null,
	"sha1_hash": "915e3585ca5c2ae8004e17647bba2f72551cbd61",
	"title": "CAPEC-532: Altered Installed BIOS (Version 3.9)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 74298,
	"plain_text": "CAPEC-532: Altered Installed BIOS (Version 3.9)\r\nArchived: 2026-04-05 20:35:54 UTC\r\nCommon Attack Pattern Enumeration and Classification\r\nA Community Resource for Identifying and Understanding Attacks\r\nHome\r\nSearch\r\nAttack Pattern ID: 532\r\nAbstraction: Detailed\r\n Description\r\nAn attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which\r\n Likelihood Of Attack\r\nLow\r\n Typical Severity\r\nHigh\r\n Relationships\r\nThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildO\r\nNature Type\r\nChildOf Standard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an atta\r\nThis table shows the views that this attack pattern belongs to and top level categories within that view.\r\nView Name\r\nDomains of Attack\r\nMechanisms of Attack\r\nSupply Chain Risks\r\n Prerequisites\r\nAdvanced knowledge about the installed target system design.\r\nAdvanced knowledge about the download and update installation processes.\r\nAccess to the download and update system(s) used to deliver BIOS images.\r\n Skills Required\r\nhttps://capec.mitre.org/data/definitions/532.html\r\nPage 1 of 3\n\n[Level: High]\r\nAble to develop a malicious BIOS image with the original functionality as a normal BIOS image, but with added functionality that allows for later c\r\n Mitigations\r\nDeploy strong code integrity policies to allow only authorized apps to run.\r\nUse endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.\r\nMaintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory\r\nRequire SSL for update channels and implement certificate transparency based verification.\r\nSign update packages and BIOS patches.\r\nUse hardware security modules/trusted platform modules to verify authenticity using hardware-based cryptography.\r\n Example Instances\r\nAn attacker compromises the download and update portion of a manufacturer's web presence, and develops a malicious BIOS that in addition to the\r\ncapabilities to entice the victim to install the new BIOS quickly. The malicious BIOS is downloaded and installed on the victim's system, which allow\r\n Taxonomy Mappings\r\nCAPEC mappings to ATT\u0026CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT\u0026CK mappings. Inherit\r\nRelevant to the ATT\u0026CK taxonomy mapping\r\nEntry ID Entry Name\r\n1495 Firmware Cor\r\n1542.001 Pre-OS Boot:\r\n References\r\n[REF-439] John F. Miller. \"Supply Chain Attack Framework and Attack Patterns\". The MITRE Corporation. 2013. \u003chttp://www.mitre.org/sites/def\r\n[REF-716] Daniel Simpson, Dani Halfin, Andrews Mariano Gorzelany and Beth Woodbury. \"Supply chain attacks\". Microsoft. 2021-10-28. \u003chttps\r\n Content History\r\nSubmissions\r\nSubmission Date Submitter\r\n2014-06-23\r\n(Version 2.6)\r\nCAPEC Content Team\r\nModifications\r\nModification Date Modifier\r\n2015-11-09\r\n(Version 2.7)\r\nCAPEC Content Team\r\nUpdated References, Related_Attack_Patt\r\n2018-07-31\r\n(Version 2.12)\r\nCAPEC Content Team\r\nUpdated References, Related_Attack_Patt\r\n2019-09-30\r\n(Version 3.2)\r\nCAPEC Content Team\r\nUpdated Related_Attack_Patterns\r\n2020-07-30 CAPEC Content Team\r\nhttps://capec.mitre.org/data/definitions/532.html\r\nPage 2 of 3\n\n(Version 3.3) Updated Taxonomy_Mappings\r\n2021-06-24\r\n(Version 3.5)\r\nCAPEC Content Team\r\nUpdated Related_Attack_Patterns\r\n2022-02-22\r\n(Version 3.7)\r\nCAPEC Content Team\r\nUpdated Mitigations, References\r\n2022-09-29\r\n(Version 3.8)\r\nCAPEC Content Team\r\nUpdated Taxonomy_Mappings\r\nPrevious Entry Names\r\nChange Date Previous Entry Name\r\n2015-11-09\r\n(Version 2.7)\r\nAltered BIOS Installed After Installation\r\nMore information is available — Please select a different filter.\r\nPage Last Updated or Reviewed: July 31, 2018\r\nSource: https://capec.mitre.org/data/definitions/532.html\r\nhttps://capec.mitre.org/data/definitions/532.html\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://capec.mitre.org/data/definitions/532.html"
	],
	"report_names": [
		"532.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434787,
	"ts_updated_at": 1775791240,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/915e3585ca5c2ae8004e17647bba2f72551cbd61.pdf",
		"text": "https://archive.orkl.eu/915e3585ca5c2ae8004e17647bba2f72551cbd61.txt",
		"img": "https://archive.orkl.eu/915e3585ca5c2ae8004e17647bba2f72551cbd61.jpg"
	}
}