Bypass Record
Pre-OS Boot × Microsoft Windows (DSE)
A publicly-reported instance of Pre-OS Boot bypassing Microsoft Windows (DSE), recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
A UEFI bootkit that executes before Windows boot, manipulating the g_CiOptions variable to disable Driver Signature Enforcement (DSE). This allows loading of unsigned drivers, defeating a core OS integrity protection. The bootkit is written in pure assembly and is only 976 bytes.
Detection & mitigation
Monitor UEFI firmware integrity using hardware root of trust (e.g., TPM measurements, Secure Boot logs) and compare boot chain hashes against known-good values. Enable Secure Boot with custom policies to block unauthorized pre-boot code, and deploy firmware integrity monitoring tools to detect unauthorized modifications to UEFI variables or bootloaders.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.