FW-LOGOFAILInitial Access

LogoFAIL (UEFI Image Parser RCE)

Boot-time image parsers in vendor UEFI accept malformed JPG/PNG/BMP from the EFI partition — pre-OS RCE before SecureBoot kicks in.

§ Where this technique fits

FW-LOGOFAIL is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

LogoFAIL → UEFI bootkit → persistent ring-0
Drop a malformed JPG/PNG/BMP into the EFI partition's boot logo path. Vulnerable vendor UEFI parses it pre-OS, executes attacker code before SecureBoot's verifier — install a bootkit that survives wipe + reinstall.
step 2 / 6

§ What commonly comes next

01
Boot or Logon Autostart Execution
T1547 · Persistence
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

LogoFAIL → UEFI bootkit → persistent ring-0

§ What commonly comes next