Detecting Secure Boot Bypass

What it does

When your agent uses it

• Auditing fleet dbx rollout after a bootkit advisory
• Hunting for pre-OS persistence on a suspected-compromised endpoint

Example prompts

• “/detecting-secure-boot-bypass”

Requirements

• Python 3

Workflow steps

10 steps, taken from the step headings in SKILL.md.

1. 1Confirm Secure Boot state (Linux)
2. 2Confirm Secure Boot state (Windows)
3. 3Enumerate the Secure Boot databases
4. 4Assess dbx freshness and applied revocations
5. 5Check Secure Boot variable protection with CHIPSEC
6. 6Hash ESP boot binaries and check signatures
7. 7Cross-check against known-bad bootkit hashes
8. 8Inspect for bootkit artifacts
9. 9Validate measured-boot evidence (optional pivot)
10. 10Run the bundled assessment helper

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • apt
  • dnf
  • pip
  • python

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • github.com

  Also links to:

  • uefi.org
  • git.kernel.org
  • support.microsoft.com
  • welivesecurity.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Detecting Secure Boot Bypass loads about 2.6k tokens when it runs, and up to ~3.5k if it reads all its reference files. Until then it costs about 114 tokens; SKILL.md has 837 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~114

When it runs · the whole SKILL.md, loaded when a task matches

~2.6k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~3.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteRuns commands with sudoSKILL.md:51

  sudo apt install mokutil efitools sbsigntool dbxtool      # Debian/Ubuntu

• NoteRuns commands with sudoSKILL.md:52

  sudo dnf install mokutil efitools sbsigntools dbxtool     # Fedora/RHEL

• NoteRuns commands with sudoSKILL.md:120

  sudo chipsec_main -m common.secureboot.variables

• NoteRuns commands with sudoSKILL.md:123

  sudo chipsec_main -m common.uefi.s3bootscript

• NoteRuns commands with sudoSKILL.md:126

  sudo chipsec_util spi dump rom.bin

• NoteRuns commands with sudoSKILL.md:167

  sudo python scripts/agent.py --check-chipsec --output secureboot_report.json

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 837 words, ~2,564 tokens.

name

detecting-secure-boot-bypass

description

Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.

domain

cybersecurity

subdomain

hardware-firmware-security

tags

hardware-firmware-security, secure-boot, uefi, bootkit, dbx-revocation, blacklotus, chipsec, firmware-integrity

version

1.0

author

mahipal

license

Apache-2.0

nist_csf

DE.CM-01

mitre_attack

T1542.003

mokutil --sb-state                       # "SecureBoot enabled" expected
bootctl status | grep -i "secure boot"   # systemd-boot view
# 6 = enabled+user mode on the EFI SecureBoot/SetupMode vars:
od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c

Confirm-SecureBootUEFI        # $true if enabled
# Inspect the raw dbx variable from Windows:
[System.BitConverter]::ToString((Get-SecureBootUEFI dbx).bytes) | Out-File dbx.hex

efi-readvar                      # dumps PK, KEK, db, dbx
efi-readvar -v dbx -o dbx.esl    # export dbx to a file for offline analysis
mokutil --list-enrolled          # MOK (shim) enrolled keys
mokutil --db                     # platform db entries via shim

dbxtool --list                                   # current dbx entries + count
# Download latest dbxupdate from uefi.org/revocationlistfile, then:
dbxtool --dbx ./DBXUpdate.bin --apply --dry-run  # show what WOULD be added (no write)

# Verify Secure Boot is enabled and the SB variables are properly protected:
sudo chipsec_main -m common.secureboot.variables

# Check S3 resume boot-script protections (an SMM/firmware bypass vector):
sudo chipsec_main -m common.uefi.s3bootscript

# Dump SPI flash for offline firmware diffing:
sudo chipsec_util spi dump rom.bin

# Locate and hash EFI boot binaries
find /boot/efi -iname '*.efi' -exec sha256sum {} \;
# Validate a binary's signature against the platform db
sbverify --list /boot/efi/EFI/BOOT/bootx64.efi
sbverify --cert /etc/secureboot/db.crt /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi
# pesign equivalent on RHEL-family:
pesign -S -i /boot/efi/EFI/BOOT/bootx64.efi

# Example: confirm a binary's SHA-256 is NOT one of the revoked CVE-2022-21894 boot managers
sha256sum /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi
# Compare against the hash list extracted from the latest dbxupdate / advisory.

# Unexpected files / recently modified binaries on the ESP
ls -laR /boot/efi/EFI/
find /boot/efi -newermt "-30 days" -iname '*.efi'
# On Windows, examine the EFI partition for rogue \EFI\Microsoft\Boot entries.

tpm2_pcrread sha256:7        # Secure Boot policy PCR

sudo python scripts/agent.py --check-chipsec --output secureboot_report.json

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/detecting-secure-boot-bypass of mukul975/Anthropic-Cybersecurity-Skills.

• SKILL.md
• LICENSE
• references/api-reference.md
• references/standards.md
• scripts/agent.py

Open the folder on GitHubat commit 54a7988