Unfortunately Microsoft provide the Windows Platform Binary Table which is a documented vendor feature, rather than nefarious malware.

You can get a rootkit on every boot as part of your UEFI, and that's a bonus.