TL;DR: Read into how others do it until you gain enough knowledge to come up with new methods yourself. To be honest, I'd start with the Wikipedia articles[1]

TL;DR: Read into how others do it until you gain enough knowledge to come up with new methods yourself. To be honest, I'd start with the Wikipedia articles[1] for the high-level fundamental overview and drill down into the linked technical documents[2] as curiosity takes you. On many PC systems, you can compile an executable for the UEFI environment, place it onto the UEFI volume by mounting the partiton, and change a file to have it execute on startup. On more secure systems, you'd utilize a chain of exploits to accomplish compromise. Also check out security researcher blogs and read CVE reports[3]. 1. https://en.wikipedia.org/wiki/Rootkit https://en.wikipedia.org/wiki/Rootkit 2. https://www.trendmicro.com/en_us/research/15/g/hacking-team-uses-uefi-bios-rootkit-to-keep-rcs-9-agent-in-target-systems.html https://www.trendmicro.com/en_us/research/15/g/hacking-team-... 3. http://cve.mitre.org/ http://cve.mitre.org/