T1693.001: System Firmware
Essential information
- MITRE technique ID
T1693.001- Confidence
- 75/100
- Revoked
- No
- Published
- 20/04/2026 22:54
- Modified
- 04/05/2026 16:52
- Author / Source
- The MITRE Corporation
Description
System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network.
An adversary may exploit the firmware update feature on accessible devices to upload malicious or out-of-date firmware. Malicious modification of device firmware may provide an adversary with root access to a device, given firmware is one of the lowest programming abstraction layers.(Citation: Basnight, Zachry, et al.)
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-ics-attack-v19 | impair-process-control |
| mitre-ics-attack | impair-process-control |
| mitre-ics-attack | inhibit-response-function |
| mitre-ics-attack-v19 | inhibit-response-function |
| mitre-ics-attack | persistence |
| mitre-ics-attack-v19 | persistence |
Marking (TLP)
Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.