Bypass Record
Pre-OS Boot × Microsoft Windows Secure Boot
A publicly-reported instance of Pre-OS Boot bypassing Microsoft Windows Secure Boot, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
BlackX exploits CVE-2024-7344, a vulnerability in a signed EFI binary, to bypass Secure Boot. The bootkit loads during the UEFI boot phase, before the operating system, allowing it to persist and evade detection by endpoint security tools that rely on OS-level visibility.
Detection & mitigation
Monitor for unauthorized changes to UEFI firmware and Secure Boot configuration using hardware security modules or firmware integrity tools. Deploy firmware updates and revocations promptly, and use endpoint detection with firmware-level telemetry where available.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.