Techniques › T1542.005 › AN1603
AN1603 Analytic 1603
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of unauthorized changes to boot configurations pointing to TFTP servers, unusual firmware loads during netbooting, or suspicious TFTP traffic. Correlation of boot config modifications, command history logs, and unexpected system image hashes provides detection coverage for adversaries attempting to persist via malicious TFTP boot images.</p>
- Detects
- T1542.005 TFTP Boot
- Part of
- DET0582 Detection Strategy for T1542.005 Pre-OS Boot: TFTP Boot
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:config | Configuration changes referencing 'boot system tftp' or modification of startup-config pointing to external TFTP servers | DC0064 Command Execution |
| networkdevice:syslog | Boot information log showing image loaded from TFTP server instead of local storage | DC0004 Firmware Modification |
| NSM:Flow | Unexpected inbound/outbound TFTP traffic for device image files | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ApprovedTFTPServers | Whitelist of TFTP servers authorized for netbooting in the environment |
TimeWindow | Detection correlation window between config change, TFTP activity, and system reboot |
BaselineBootImageHash | Expected system image hashes to validate integrity of boot images loaded via TFTP |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2017-6742 | Cisco IOS and IOS XE Software | Mapped |