The guide covers:

• Techniques to determine if devices in an organization are infected
• Recovery and prevention strategies to protect your environment

It is critical to note that a threat actor’s use of this bootkit is primarily a persistence and defense evasion mechanism, the Microsoft researchers said. It is not a first-stage payload or an initial access vector and can only deploy to a device to which a threat actor has already gained either privileged access or physical access.

The malware uses CVE-2022-21894 (also known as Baton Drop) to bypass Windows Secure Boot and subsequently deploy malicious files to the EFI System Partition (ESP) launched by the UEFI firmware.

This allows the bootkit to:

• Achieve persistence by enrolling the threat actor’s Machine Owner Key (MOK)
• Turn off HVCI to allow deployment of a malicious kernel driver
• Leverage the kernel driver to deploy the user-mode HTTP downloader for command and control (C2)
• Turn off Bitlocker to avoid tamper protection strategies on Windows
• Turn off Microsoft Defender Antivirus to avoid further detection

Microsoft Incident Response, through forensic analysis of devices infected with BlackLotus, identified multiple opportunities for detection along several steps in its installation and execution processes, including:

• Recently written bootloader files
• Staging directory artifacts created
• Registry key modified
• Windows Event logs entries generated
• Network behavior
• Boot Configuration log entries generated

BlackLotus writes malicious bootloader files to the EFI system partition (ESP) and subsequently locks them to protect them from deletion or tampering, the researchers said. If recently modified and locked files are in the ESP on a device, especially those matching known BlackLotus bootloader filenames, these should be highly suspect and the devices should end up removed from the network for examination for further evidence of BlackLotus or follow-on activity.

To determine if such files exist in the ESP, threat hunters can mount the boot partition (with the mountvol command-line utility, for example) to examine the creation dates of the files within. Files with mismatched creation times, as well as those with names matching those protected by the BlackLotus kernel driver, are suspicious. The LastModified timestamps of the files in the ESP should be compared to each other; the timestamps and filenames can also compare against those in the OS partition under C:\Windows\Boot\EFI.

Click here for more on the BlackLotus advisory.