Firmware Corruption
Technique · ATTACK:enterprise:T1495
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1495",
"title": "Firmware Corruption",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1495",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--f5bb433e-bdf6-4781-84bc-35e97e43be89",
"external_id": "T1495",
"domain": "enterprise",
"created": "2019-04-12T18:28:15.451Z",
"modified": "2026-05-12T15:12:00.724Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "cisa_malware_orgs_ukraine",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-057a"
},
{
"source_name": "dhs_threat_to_net_devices",
"url": "https://cyber.dhs.gov/assets/report/ar-16-20173.pdf"
},
{
"source_name": "MITRE Trustworthy Firmware Measurement",
"url": "http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research"
},
{
"source_name": "Symantec Chernobyl W95.CIH",
"url": "https://web.archive.org/web/20190508170055/https://www.symantec.com/security-center/writeup/2000-122010-2655-99"
}
]
}Explicit source assertions (6)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2374acc8-5a15-40cb-bafc-d74c5097249b
Secure List Bad RabbitATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25a84607-970c-474e-83bc-143e2ccbb64b
ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3ede3cc-37f1-4c57-bc2f-e1c65b25c578
CERT PolskaATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acece0c4-4c9e-4c11-a57a-f01bb23abbf7
Eclypsium Trickboot December 2020ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4dafcd2-fed8-4266-b83e-f4033ada0d55
ATTACK:enterprise:M1046 → mitigates → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f365854f-76e6-4746-bab8-2f2b94b50087