BlackX Baton Drop: Untrusted EFI Partition Write Followed by Boot Config Change
Detects potential bootkit activity or unauthorized modifications to the EFI system partition by correlating non-standard .efi file writes with subsequent execution of boot configuration utilities like bcdedit or mountvol within a 30-minute window.
Microsoft Sentinel (KQL)
