Rule Info
Name
MAL_UEFI_XigMapper_Bootkit_Sep26
Author
Pierre-Henri Pezier
Description
Detects Xigmapper UEFI bootkit that installs hooks into ntoskrnl.exe to load malicious kernel modules
Score
80
Date
2026-09-08
Minimum Yara
3.6.0
Rule Hash
867d7887f6839664a9d3f25ad570d4f4
Tags
['MAL']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
2
Suspicious (< 10 engines)
11
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR