UEFI has an “A Priori File”, which lets vendors list the explicit drivers to load, to override traditional hardware bus enumeration. This is a security issue: if an attacker was able to modify this, then the game is over, their drivers are loaded. From a Tianocore FAQ:
There is another method called an a priori file. There can be one per Firmware volume. This will tell the dispatcher what order to dispatch list drivers in the order they need to dispatch them. This is a manual order. It does not need to be in any specific place in the FV. If it in the FV the dispatcher will find it.
Bluntly, I don’ t know the right way to efficiently search for A Priori Files on UEFI systems, probably using GUIDs via UEFI Tool. EDK-I — but not, apparently, EDK-II — had a GenApriorFile tool. If someone knows how, please speak up. Anyway, in an ideal world, you’ll be searching all of your firmware volumes for an A Priori File …as well as the UEFI Shell’s ‘autoexec.bat’ equivalent: startup.nsh, the latter may be anywhere in the path.
http://tianocore.sourceforge.net/wiki/EDK_II_FAQ#Is_an_a_priori_file_checked_first.3F
Firmware Security 