VORANT. Threat Intelligence Sign in Get the full feed

UEFI Shell flaw enables Secure Boot bypass

routine vulnerability technology

A UEFI Shell technique lets attackers with boot-entry write access bypass Secure Boot and execute code in the pre-boot environment.

CERT/CC has published a vulnerability note (VU#718077) describing a technique, discovered by Eclypsium researcher Stas Lyakhov, that abuses the TianoCore EDK II UEFI Shell to circumvent UEFI Secure Boot protections. Many OEM and IBV firmware implementations bundle the UEFI Shell in SPI flash for diagnostic and support purposes, and typically suppress its boot entry when Secure Boot is enabled. An attacker who can create or modify UEFI boot entries can reference the shell anyway, then leverage its memory-access commands (such as dmem and mm) and startup scripting capabilities to overwrite Secure Boot-related memory values and execute unauthorized code before the operating system loads.

Successful exploitation could give an attacker persistent, pre-boot level access capable of surviving reboots and even OS reinstallation, while degrading the effectiveness of OS-based security tools and EDR. This is a firmware supply-chain-adjacent issue affecting a broad range of platforms that ship EDK II's UEFI Shell, making the potential exposure wide but requiring the attacker to first have the ability to modify UEFI boot configuration (e.g., via existing privileged access or a separate compromise).

CERT/CC recommends organizations apply OEM firmware patches as they become available, review and monitor Secure Boot configuration and boot entry changes, and coordinate UEFI firmware updates through existing firmware lifecycle management processes since these updates are typically separate from standard OS patching. No in-the-wild exploitation has been reported; this is disclosed as a researcher-identified technique with vendor coordination underway.

Related reporting

Detection guidance

UEFI Boot Entry Creation or Modification

ATT&CK T1542.001

Detects creation or modification of UEFI boot entries, which could indicate an attempt to reference the UEFI Shell or other pre-boot code to bypass Secure Boot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: UEFI Boot Entry Creation or Modification
description: Detects processes creating or modifying UEFI boot entries via bcdedit
  or efibootmgr commands. Attackers may add or modify entries to reference the UEFI
  Shell or other firmware code to circumvent Secure Boot protections.
tags:
- attack.persistence
- attack.t1542.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - /set
    - /create
    - /copy
  selection_efibootmgr:
    Image|endswith: \efibootmgr.exe
    CommandLine|contains:
    - -c
    - -C
    - -n
    - -N
  filter_system_account:
    User: NT AUTHORITY\SYSTEM
    CommandLine|contains: OfficeClickToRun
  filter_legitimate_admin:
    CommandLine|contains:
    - recoveryenabled
    - bootstatuspolicy
  condition: (selection_bcdedit or selection_efibootmgr) and not filter_system_account
    and not filter_legitimate_admin
falsepositives:
- Legitimate OS recovery or boot configuration management by administrators
- OEM firmware update utilities modifying boot entries
level: high
id: 17b10f97-d15f-517b-9685-25c81fe90e99
status: experimental
author: Vorant

Secure Boot Configuration Modification

ATT&CK T1553.006

Detects commands or registry operations that disable, modify, or bypass Secure Boot settings, which could indicate preparation for UEFI Shell exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Secure Boot Configuration Modification
description: Detects attempts to disable or modify Secure Boot settings via bcdedit,
  registry operations, or direct firmware access. Such changes may precede exploitation
  of UEFI Shell to bypass boot security.
tags:
- attack.defense-evasion
- attack.t1553.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_bcdedit_secureboot:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - secureboot
    - integrityservices
  selection_powershell_firmware:
    Image|endswith: \powershell.exe
    CommandLine|contains:
    - Get-SecureBootUEFI
    - Set-SecureBootUEFI
    - Confirm-SecureBootUEFI
  filter_legitimate_admin:
    CommandLine|contains:
    - 'off'
    - recoveryenabled
    User|contains:
    - SYSTEM
    - Administrator
  condition: (selection_bcdedit_secureboot or selection_powershell_firmware) and not
    filter_legitimate_admin
falsepositives:
- Legitimate Secure Boot diagnostics by system administrators
- OEM firmware utilities or BIOS update tools
level: high
id: dea084bc-bc75-53ca-bd53-6668b27d0a9a
status: experimental
author: Vorant

UEFI Shell Invocation via Boot Entry

ATT&CK T1542.001

Detects boot entry modifications that reference UEFI Shell binaries or startup script paths, indicating potential setup for pre-OS code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: UEFI Shell Invocation via Boot Entry
description: Detects bcdedit or boot-related commands that explicitly reference UEFI
  Shell paths, NSH scripts, or firmware diagnostic utilities in boot entries. This
  behavior indicates potential pre-OS code execution setup.
tags:
- attack.persistence
- attack.t1542.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_shell_reference:
    CommandLine|contains:
    - shell.efi
    - .nsh
    - UefiShell
    - Shell.nsh
  selection_bcdedit_context:
    Image|endswith: \bcdedit.exe
  condition: selection_bcdedit_context and selection_shell_reference
falsepositives:
- Legitimate OEM firmware diagnostics or recovery tools referencing UEFI Shell
- Authorized firmware update or deployment scripts
level: high
id: 879783cb-aa92-5131-a000-46b66836e7ff
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/718077

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free