Plan
archived
11 Old Microsoft-Signed UEFI Shims Enable Secure Boot Bypass
- Engineer — Plan: No active exploitation or PoC yet, but these are legitimately signed shims that could be weaponized for UEFI bootkit deployment — audit your systems’ Secure Boot allowlists and verify no deprecated shim binaries are present in your boot chain.
- SOC/IR — Learn: UEFI bootkit delivery via trusted-but-vulnerable signed shims is a useful persistence vector to understand; no exploitation is occurring now and no IOCs or detection guidance are available yet, but worth filing against future UEFI anomaly detection work.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.