Анализ буткитов и руткитов уровня прошивки

★ 8.4 · security

analyzing-bootkit-and-rootkit-samples is a Claude Code skill that analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to achieve persistence below the operating system level. The workflow covers disk acquisition with dd and FTK Imager, 16-bit MBR disassembly via ndisasm, UEFI firmware volume inspection with UEFITool and chipsec, YARA-based detection of known implants such as LoJax, BlackLotus, CosmicStrand, and MoonBounce, plus Volatility 3 memory forensics for uncovering DKOM-hidden processes and SSDT hooks. It is intended for cases where compromise survives OS reinstallation, antivirus and EDR fail despite clear infection signs, or an investigation targets nation-state threats like APT28 or the Equation Group. Standard user-mode malware analysis is outside its scope.