Boot-chain persistence is a way for malware to survive a reboot by embedding itself in, or modifying, components used to start a device. Because the boot process begins before the operating system and many endpoint security tools load, this persistence can be harder to detect and remove than ordinary software that runs inside the operating system.
In real attacks, a bootkit may target firmware or boot components so malicious code runs early in startup and can regain control after each reboot. Defenders should not assume that a clean operating-system scan or current software updates prove the boot chain is trustworthy. Verify Secure Boot is enabled and correctly configured, apply relevant firmware and boot-component updates and revocations, and investigate unexpected changes to startup behavior. Remediation may require trusted recovery procedures rather than simply deleting files from the running system.