CAPEC-532: Altered Installed BIOS (Version 3.9) Archived: 2026-04-05 20:35:54 UTC Common Attack Pattern Enumeration and Classification A Community Resource for Identifying and Understanding Attacks Home Search Attack Pattern ID: 532 Abstraction: Detailed Description An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which Likelihood Of Attack Low Typical Severity High Relationships This table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildO Nature Type ChildOf Standard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an atta This table shows the views that this attack pattern belongs to and top level categories within that view. View Name Domains of Attack Mechanisms of Attack Supply Chain Risks Prerequisites Advanced knowledge about the installed target system design. Advanced knowledge about the download and update installation processes. Access to the download and update system(s) used to deliver BIOS images. Skills Required https://capec.mitre.org/data/definitions/532.html Page 1 of 3 [Level: High] Able to develop a malicious BIOS image with the original functionality as a normal BIOS image, but with added functionality that allows for later c Mitigations Deploy strong code integrity policies to allow only authorized apps to run. Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities. Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory Require SSL for update channels and implement certificate transparency based verification. Sign update packages and BIOS patches. Use hardware security modules/trusted platform modules to verify authenticity using hardware-based cryptography. Example Instances An attacker compromises the download and update portion of a manufacturer's web presence, and develops a malicious BIOS that in addition to the capabilities to entice the victim to install the new BIOS quickly. The malicious BIOS is downloaded and installed on the victim's system, which allow Taxonomy Mappings CAPEC mappings to ATT&CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT&CK mappings. Inherit Relevant to the ATT&CK taxonomy mapping Entry ID Entry Name 1495 Firmware Cor 1542.001 Pre-OS Boot: References [REF-439] John F. Miller. "Supply Chain Attack Framework and Attack Patterns". The MITRE Corporation. 2013.