Analyzes bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence below the operating system. Covers boot sector analysis, UEFI module inspection, and anti-rootkit detection techniques. Activates for requests involving bootkit analysis, MBR malware investigation, UEFI persistence analysis, or pre-OS malware detection.
SkillScore13Maintained
Automatic
◆Security & AppSec pack
Last verified 7/27/2026
What it changes
Passed 3 of 23 test cases with the skill, and 2 of 23 without it.
Without skill9%
With skill13%
1 fixed2 passed either way20 still failing0 broke
Pass-rate lift
+4 pp
Tokens
+195%
Agent turns
0%
Response time
-24%
Model gemini-3.6-flashMeasured 7/27/2026v13 of 23 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
What's inside
The instructions your model reads when the skill loads.
SKILL.md328 lines3 filesincludes scripts
Analyzing Bootkit and Rootkit Samples
When to Use
A system shows signs of compromise that persist through OS reinstallation
Antivirus and EDR are unable to detect malware despite clear evidence of compromise
UEFI Secure Boot has been disabled or shows integrity violations
Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)
Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)
Do not use for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.
Prerequisites
Disk imaging tools (dd, FTK Imager) for acquiring MBR/VBR sectors
UEFITool for UEFI firmware volume analysis and module extraction
chipsec for hardware-level firmware security assessment
Ghidra with x86 real-mode and 16-bit support for MBR code analysis
Volatility 3 for kernel-level rootkit artifact detection
Bootable Linux live USB for offline system analysis
Workflow
Step 1: Acquire Boot Sectors and Firmware
Extract MBR, VBR, and UEFI firmware for offline analysis:
# Acquire MBR (first 512 bytes of disk)
dd if=/dev/sda of=mbr.bin bs=512 count=1
# Acquire first track (usually contains bootkit code beyond MBR)
dd if=/dev/sda of=first_track.bin bs=512 count=63
# Acquire VBR (Volume Boot Record - first sector of partition)
dd if=/dev/sda1 of=vbr.bin bs=512 count=1
# Acquire UEFI System Partition
mkdir /mnt/efi
mount /dev/sda1 /mnt/efi