Skip to content
Get packs

UEFI Bootkit Persistence Analysis

Guides an agent through checking firmware, UEFI variables, and the EFI partition for bootkit implants.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill gives an AI agent a step-by-step playbook for investigating whether a computer's startup firmware (UEFI) has been tampered with by malware. It walks through dumping firmware, checking Secure Boot settings and UEFI variables, inspecting the EFI System Partition for unexpected boot files, and comparing results against known families such as BlackLotus, LoJax, and MoonBounce. It is aimed at defensive analysts, not at people who want to build bootkits.

Great for

  • Incident responders investigating suspected firmware or boot-level persistence
  • Security auditors checking firmware integrity and Secure Boot posture against vendor baselines
  • Students learning UEFI malware analysis with chipsec and related tools

Skip it if

  • Routine PC troubleshooting, since the steps involve dumping firmware and changing boot-related settings that can make a system unbootable if done wrongly
  • Legacy BIOS/MBR bootkits, which the skill itself says to handle with different methods
  • Analysis of machines you are not authorized to examine, because firmware dumping and boot inspection carry legal and policy implications

Try asking

  • “Check this laptop's Secure Boot variables and tell me if anything looks tampered with”
  • “Compare my firmware dump against the vendor baseline and flag modified modules”
  • “Inspect the EFI System Partition for unexpected .efi files and hash them”
  • “Explain whether this Windows boot configuration shows signs of BlackLotus-style bypass”
Step-by-step guide: how to use UEFI Bootkit Persistence AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-uefi-bootkit-persistence.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-uefi-bootkit-persistence.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-uefi-bootkit-persistence.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run analysis from a trusted offline live USB rather than the suspect OS, as the skill recommends.
  • Obtain vendor firmware baselines and known-good hashes before starting, since most checks are comparisons.
  • Review scripts/agent.py and the referenced commands before running them, especially anything that writes to firmware or ESP.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.