Tag
high
advisory
CVE-2026-24090 - Qualcomm Cryptographic Issue in Partition Table Processing
2 rules 2 TTPs 1 CVECVE-2026-24090 is a cryptographic issue in Qualcomm chipsets while processing partition table entries, allowing unauthorized modification of the boot flow due to missing authentication for critical functions.
cve
bootkit
qualcomm
partition table
2r
2t
1c
high
advisory
Windows EFI Bootloader File Modification Detection
2 rules 1 TTP 1 CVEA process writing to critical EFI bootloader files (bootmgfw.efi or bootx64.efi) within the \EFI\Boot\ directory may indicate a bootkit installation, malicious code persistence at the firmware level, or tampering with the system boot process.
Splunk Enterprise +2
bootkit
persistence
efi
bootloader
windows
2r
1t
1c
high
advisory
Ransomware Attempting to Disable Windows Recovery via Bcdedit
2 rules 1 TTPThis brief details the detection of ransomware actors using bcdedit.exe to modify boot settings, specifically disabling automatic repair mode to hinder system recovery.
Windows
ransomware
bootkit
2r
1t