t1542 | LoFP

t1542

Title	Tags
false positives may be present and will need to be filtered.	t1542 t1547.001 endpoint splunk
legitimate usage of the file by hardware manufacturer such as lenovo (thanks @0gtweet for the tip)	t1542 t1542.001 windows sigma
mounting the efi volume can be part of normal system updates or legitimate maintenance tasks. monitor for unusual timing or context to reduce false alerts.	t1204.002 t1542 T1688 endpoint splunk