Abstract: In some embodiments, a method of detecting pre-operating system malicious software and firmware using chipset general purpose direct memory access hardware capabilities is presented. In this regard, a security agent is introduced to access system memory used by instructions executing on a host processor or microcontroller, to copy contents from the system memory to an internal chipset memory, and to scan the internal memory with an embedded processor for a malicious software pattern. Other embodiments are also disclosed and claimed.