Which SIEM platforms have a T1542.005 detection rule?

df00tech provides T1542.005 (TFTP Boot) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect TFTP Boot (T1542.005)?

Detecting TFTP Boot requires the following data sources: Network Device: Network Device Configuration, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Cisco IOS Syslog.

What severity and confidence is the T1542.005 detection?

The T1542.005 detection is rated critical severity with medium confidence.

What are common false positives for T1542.005?

Common false positives for T1542.005 include: Legitimate network operations teams performing scheduled IOS upgrades via TFTP from authorized network management servers (e.g., Cisco Prime, SolarWinds NCM); Password recovery procedures — IOS password recovery requires setting config-register to 0x2142 (ROMMON bypass) which overlaps with TFTP boot register values; Lab or test environment provisioning where TFTP netbooting is intentionally used for device imaging.

T1542.005 Elastic Security · Elastic

Detect TFTP Boot in Elastic Security

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with Modify System Image to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality.

MITRE ATT&CK

Tactic: Defense Evasion Persistence
Technique: T1542 Pre-OS Boot
Sub-technique: T1542.005 TFTP Boot
Canonical reference: https://attack.mitre.org/techniques/T1542/005/

Elastic Detection Query

Elastic Security (Elastic)

eql

sequence by host.name with maxspan=2h
  [any where event.dataset == "system.syslog" and
   (
     message like~ "*boot system tftp*" or
     message like~ "*BOOT system tftp*" or
     message like~ "*config-register 0x2100*" or
     message like~ "*config-register 0x2102*" or
     message like~ "*config-register 0x2140*" or
     message like~ "*config-register 0x2142*" or
     message like~ "*tftpdnld*"
   )
  ]
  [any where event.dataset == "system.syslog" and
   (
     message like~ "*SYS-5-RELOAD*" or
     message like~ "*SYS-5-RESTART*" or
     message like~ "*SYS-6-RELOAD*" or
     message like~ "*Reload requested*" or
     message like~ "*reload in *" or
     message like~ "*reload at *"
   )
  ]

// Alternative: single-event detection for TFTP image transfer
any where event.dataset == "system.syslog" and
(
  (message like~ "*tftp://*" or message like~ "*TFTP*") and
  (
    message like~ "*.bin*" or message like~ "*.tar*" or
    message like~ "*.pkg*" or message like~ "*.img*" or
    message like~ "*c3750*" or message like~ "*c2960*" or
    message like~ "*c7200*" or message like~ "*asr*" or
    message like~ "*catalyst*" or message like~ "*nexus*"
  )
)

high severity medium confidence

Detects TFTP Boot abuse (T1542.005) by sequencing Cisco IOS syslog events: first a TFTP boot configuration change or rommon register modification, then a device reload within a 2-hour window. Also detects standalone TFTP image transfer events referencing known Cisco platform firmware naming conventions.

Data Sources

Cisco IOS syslog (forwarded via rsyslog/Filebeat)Network device syslog via Elastic Agent

Required Tables

logs-system.syslog-*filebeat-*

False Positives & Tuning

Legitimate network device OS upgrades by network engineers following change control procedures — TFTP boot config changes paired with scheduled maintenance windows
Network device disaster recovery testing where TFTP boot is configured and tested as part of BCP/DR exercises
Automated network device provisioning systems (e.g., Cisco DNA Center, NSO) that legitimately push new images via TFTP on a schedule

Download portable Sigma rule (.yml)

Other platforms for T1542.005

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Enumerate Current Boot System Configuration on Cisco IOS Device
Expected signal: TACACS+/RADIUS authentication log entry for the SSH login from the test source IP to the device management IP. Cisco IOS syslog SYS-5-CONFIG_I is NOT generated for show commands. AAA accounting records (if enabled) will show 'show version', 'show bootvar', 'show running-config' commands. In Sentinel: Syslog table entries for the authentication event from the device. In Splunk: cisco:ios sourcetype entries for the AAA events.
Test 2Add TFTP Boot System Command to Cisco IOS Configuration
Expected signal: Cisco IOS syslog event SYS-5-CONFIG_I: 'Configured from console by <user> on <interface>' — generated when running config is modified. The syslog message includes 'boot system tftp' and 'config-register 0x2100' in the config change context. TACACS+ accounting records will show the 'boot system tftp' and 'config-register' commands if command accounting is enabled. In Sentinel: Syslog table entries matching 'boot system tftp' and 'config-register 0x2100'. In Splunk: cisco:ios sourcetype entries triggering the BOOT_CONFIG_CHANGE indicator.
Test 3Simulate TFTP Image Transfer to Network Device Management IP
Expected signal: Network flow data: UDP/69 traffic from the test source IP to <TFTP_SERVER_IP> with byte count matching the file size. Firewall logs: connection entries for UDP/69. If the TFTP server forwards to syslog: TFTPD transfer completion messages including filename 'c3750e-universalk9-mz.152-4.E10.bin'. In Sentinel: CommonSecurityLog entries for the TFTP connection if firewall forwards to Sentinel. In Splunk: network sourcetype entries for the UDP/69 flows triggering the TFTP_IMAGE_TRANSFER indicator.
Test 4Trigger Device Reload After TFTP Configuration (Highest-Fidelity Composite Test)
Expected signal: Cisco IOS syslog: SYS-5-CONFIG_I for the boot system/config-register changes, followed by SYS-5-RELOAD 'Reload requested by <user>' and SYS-5-RELOAD 'Reload scheduled in 5 minutes'. After reload: SYS-5-RESTART 'System restarted'. In Sentinel: Syslog table captures all events; the CorrelatedEvents subquery in the KQL detection fires because TFTPTransferEvents (boot system tftp) and ReloadEvents (SYS-5-RELOAD) appear within 120 minutes on the same device. In Splunk: has_tftp_and_reload=1 because both BOOT_CONFIG_CHANGE and RELOAD_EVENT indicator types appear for the same host within the transaction maxspan.

Last updated: 2026-04-20 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1542.005 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect TFTP Boot in Elastic Security

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1542.005

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1542.005

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox