skills.rest
Axxxxxxaaann
AxxxxxxaaannCOMMUNITY
Explore all skills by this author →
GitHub

analyzing-bootkit-and-rootkit-samples

Detect bootkit and rootkit infections via MBR/VBR and UEFI implant analysis.

Updated Aug 27, 2026
Search Tags:#forensics#uefi#mbr#vbr#bootkit#rootkit
One-click install
npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-bootkit-and-rootkit-samples-axxxxxxaaann
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: analyzing-bootkit-and-rootkit-samples
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-bootkit-and-rootkit-samples
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-bootkit-and-rootkit-samples-axxxxxxaaann

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Bootkit and rootkit compromises at the firmware and boot level evade standard endpoint defenses, enabling persistent access across OS reinstallations and re-imaging. This Skill provides a structured approach to detect, inventory, and document boot-level compromises across MBR, VBR, and UEFI, with guidance on remediation.

Core Features & Use Cases

  • MBR/VBR and UEFI firmware analysis to identify implants, modified sectors, and rogue DXE drivers.
  • Kernel rootkit detection and memory-forensics integration using Volatility 3 to surface hidden processes, hooks, and unsigned drivers.
  • Boot chain integrity verification, Secure Boot assessment, and evidence-backed remediation recommendations.
  • Comprehensive reporting workflow that captures findings, attribution hints, and prioritized remediation steps.

Quick Start

Boot from a trusted environment and run the agent against a raw MBR image to begin bootkit/rootkit assessment.

Frequently Asked Questions about analyzing-bootkit-and-rootkit-samples

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect UEFI implants and MBR bootkit infections that survive OS reinstallation?▼

To detect bootkit infections surviving OS reinstallation, analyze firmware and boot levels for UEFI implants and modified MBR/VBR sectors. This skill extracts boot sectors and inventories firmware to identify rogue DXE drivers and boot-level persistence.

How do I analyze memory forensics evidence for kernel rootkit activity?▼

Analyze memory forensics evidence for kernel rootkit activity by using Volatility 3 to surface hidden processes, hooks, and unsigned drivers. The skill integrates memory analysis to verify boot chain integrity and identify kernel-level rootkit artifacts.

Can I verify Secure Boot status and boot chain integrity on a compromised system?▼

You can verify Secure Boot status and boot chain integrity on a compromised system by assessing UEFI firmware configurations and extracting boot sectors. This identifies modified sectors and verifies Secure Boot protections against bootkit threats.

What is the best way to extract and analyze a raw MBR image for bootkit assessment?▼

The best way to extract and analyze a raw MBR image for bootkit assessment is to boot from a trusted environment and run the analysis agent against the image. This safely identifies modified boot sectors and determines persistence mechanisms without triggering the rootkit.

How do I generate remediation guidance after finding VBR or firmware implants?▼

Generate remediation guidance after finding VBR or firmware implants by following the skill's comprehensive reporting workflow. This captures findings, attribution hints, and prioritized remediation steps to clean boot-level compromises and restore Secure Boot integrity.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

analyzing-bootkit-and-rootkit-samples

Analyze bootkit and rootkit samples across MBR, VBR, and UEFI firmware.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-uefi-bootkit-persistence

Analyze UEFI bootkit persistence via CHIPSEC SPI dumps and ESP inspection.

Community
Advanced
YukiIto1999YukiIto1999

detecting-rootkit-activity

Detect hidden rootkit activity in memory dumps using Volatility 3 cross-view analysis.

Community
Advanced
BrownFineSecurityBrownFineSecurity
811

chipsec

Analyze offline UEFI firmware dumps to detect malware and vulnerabilities.

Official
Advanced