Which SIEM platforms have a T1542.005 detection rule?

df00tech provides T1542.005 (TFTP Boot) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect TFTP Boot (T1542.005)?

Detecting TFTP Boot requires the following data sources: Network Device: Network Device Configuration, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Cisco IOS Syslog.

What severity and confidence is the T1542.005 detection?

The T1542.005 detection is rated critical severity with medium confidence.

What are common false positives for T1542.005?

Common false positives for T1542.005 include: Legitimate network operations teams performing scheduled IOS upgrades via TFTP from authorized network management servers (e.g., Cisco Prime, SolarWinds NCM); Password recovery procedures — IOS password recovery requires setting config-register to 0x2142 (ROMMON bypass) which overlaps with TFTP boot register values; Lab or test environment provisioning where TFTP netbooting is intentionally used for device imaging.

T1542.005 Google Chronicle · YARA-L

Detect TFTP Boot in Google Chronicle

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with Modify System Image to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality.

MITRE ATT&CK

Tactic: Defense Evasion Persistence
Technique: T1542 Pre-OS Boot
Sub-technique: T1542.005 TFTP Boot
Canonical reference: https://attack.mitre.org/techniques/T1542/005/

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule tftp_boot_abuse_t1542_005 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects TFTP Boot abuse (T1542.005) — adversaries manipulating network device boot configuration to load malicious OS images via TFTP, potentially combined with device reload to activate the implanted image."
    mitre_attack_tactic = "Defense Evasion, Persistence"
    mitre_attack_technique = "T1542.005"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1542/005/"
    created = "2026-04-20"

  events:
    // Boot system TFTP configuration change event
    $boot_config.metadata.product_name = /[Cc]isco/ nocase
    $boot_config.metadata.event_type = "GENERIC_EVENT"
    (
      $boot_config.metadata.description = /boot system tftp/i or
      $boot_config.metadata.description = /config-register 0x2100/i or
      $boot_config.metadata.description = /config-register 0x2102/i or
      $boot_config.metadata.description = /config-register 0x2140/i or
      $boot_config.metadata.description = /config-register 0x2142/i or
      $boot_config.metadata.description = /tftpdnld/i
    )
    $boot_config.principal.hostname = $device

    // Reload event from same device within 2 hours
    $reload.metadata.product_name = /[Cc]isco/ nocase
    $reload.metadata.event_type = "GENERIC_EVENT"
    (
      $reload.metadata.description = /SYS-5-RELOAD/i or
      $reload.metadata.description = /SYS-5-RESTART/i or
      $reload.metadata.description = /SYS-6-RELOAD/i or
      $reload.metadata.description = /Reload requested/i or
      $reload.metadata.description = /reload in /i
    )
    $reload.principal.hostname = $device

  match:
    $device over 2h

  condition:
    $boot_config and $reload
}

rule tftp_image_transfer_t1542_005 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects TFTP image transfer events referencing Cisco platform firmware file patterns — a precursor or component of TFTP Boot abuse (T1542.005)."
    mitre_attack_tactic = "Defense Evasion, Persistence"
    mitre_attack_technique = "T1542.005"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1542/005/"
    created = "2026-04-20"

  events:
    $tftp_transfer.metadata.product_name = /[Cc]isco/ nocase
    $tftp_transfer.metadata.event_type = "GENERIC_EVENT"
    (
      $tftp_transfer.metadata.description = /tftp:\/\//i or
      $tftp_transfer.metadata.description = /TFTP_SERVER/i or
      $tftp_transfer.metadata.description = /tftpdnld/i
    )
    (
      $tftp_transfer.metadata.description = /\.bin/i or
      $tftp_transfer.metadata.description = /\.tar/i or
      $tftp_transfer.metadata.description = /\.pkg/i or
      $tftp_transfer.metadata.description = /\.img/i or
      $tftp_transfer.metadata.description = /c3750|c2960|c7200|asr|isr|catalyst|nexus/i
    )
    $tftp_transfer.principal.hostname = $device

  match:
    $device over 7d

  condition:
    $tftp_transfer
}

high severity medium confidence

Two Chronicle YARA-L 2.0 rules detecting TFTP Boot abuse (T1542.005): the first sequences a boot system TFTP configuration change or ROMMON register modification with a device reload event from the same network device within a 2-hour window; the second independently flags TFTP image transfer events referencing Cisco platform firmware naming patterns.

Data Sources

Cisco IOS syslog ingested into Chronicle via forwarderNetwork device log sources parsed into Chronicle UDM GENERIC_EVENT type

Required Tables

GENERIC_EVENT UDM records from Cisco log sources

False Positives & Tuning

Authorized firmware upgrade cycles where network engineers configure TFTP boot and immediately reload devices as part of the upgrade procedure
Network device automated provisioning platforms that use TFTP as the image delivery mechanism and trigger reloads as part of the provisioning workflow
TFTP-based disaster recovery tests that simulate ROMMON recovery procedures using TFTP image loading in lab or failover environments

Download portable Sigma rule (.yml)

Other platforms for T1542.005

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Enumerate Current Boot System Configuration on Cisco IOS Device
Expected signal: TACACS+/RADIUS authentication log entry for the SSH login from the test source IP to the device management IP. Cisco IOS syslog SYS-5-CONFIG_I is NOT generated for show commands. AAA accounting records (if enabled) will show 'show version', 'show bootvar', 'show running-config' commands. In Sentinel: Syslog table entries for the authentication event from the device. In Splunk: cisco:ios sourcetype entries for the AAA events.
Test 2Add TFTP Boot System Command to Cisco IOS Configuration
Expected signal: Cisco IOS syslog event SYS-5-CONFIG_I: 'Configured from console by <user> on <interface>' — generated when running config is modified. The syslog message includes 'boot system tftp' and 'config-register 0x2100' in the config change context. TACACS+ accounting records will show the 'boot system tftp' and 'config-register' commands if command accounting is enabled. In Sentinel: Syslog table entries matching 'boot system tftp' and 'config-register 0x2100'. In Splunk: cisco:ios sourcetype entries triggering the BOOT_CONFIG_CHANGE indicator.
Test 3Simulate TFTP Image Transfer to Network Device Management IP
Expected signal: Network flow data: UDP/69 traffic from the test source IP to <TFTP_SERVER_IP> with byte count matching the file size. Firewall logs: connection entries for UDP/69. If the TFTP server forwards to syslog: TFTPD transfer completion messages including filename 'c3750e-universalk9-mz.152-4.E10.bin'. In Sentinel: CommonSecurityLog entries for the TFTP connection if firewall forwards to Sentinel. In Splunk: network sourcetype entries for the UDP/69 flows triggering the TFTP_IMAGE_TRANSFER indicator.
Test 4Trigger Device Reload After TFTP Configuration (Highest-Fidelity Composite Test)
Expected signal: Cisco IOS syslog: SYS-5-CONFIG_I for the boot system/config-register changes, followed by SYS-5-RELOAD 'Reload requested by <user>' and SYS-5-RELOAD 'Reload scheduled in 5 minutes'. After reload: SYS-5-RESTART 'System restarted'. In Sentinel: Syslog table captures all events; the CorrelatedEvents subquery in the KQL detection fires because TFTPTransferEvents (boot system tftp) and ReloadEvents (SYS-5-RELOAD) appear within 120 minutes on the same device. In Splunk: has_tftp_and_reload=1 because both BOOT_CONFIG_CHANGE and RELOAD_EVENT indicator types appear for the same host within the transaction maxspan.

Last updated: 2026-04-20 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1542.005 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect TFTP Boot in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1542.005

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1542.005

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox