Simple definition
A bootkit is malicious software that alters or subverts boot components so that its code runs before the operating system loads normally.
Purpose and use
Its malicious purpose is early and persistent access to a machine. It is not a prevention or defense tool.
How does it work?
Depending on the platform, affected components may include boot records, the loader or other parts of the boot chain. This can make detection and removal from the infected operating system difficult.
Key points
- Example: an unexpected EFI system partition change needs comparison with legitimate updates and other evidence.
- Check boot integrity with suitable tools and preserve evidence needed for investigation.
Points to watch
Reinstalling only the operating system does not always establish that the entire boot chain is clean. Remediation depends on the component actually compromised.
In short
A bootkit seeks persistence in the boot process; incident response must address that layer.