Detect TFTP Boot in CrowdStrike LogScale

// T1542.005 — TFTP Boot: CrowdStrike LogScale detection via Falcon network device telemetry
// NOTE: Falcon does not natively instrument Cisco IOS devices. This query targets:
// (1) Falcon-protected Linux/Windows TFTP servers being accessed by network devices
// (2) Custom syslog ingest pipelines forwarding Cisco IOS logs into LogScale

// Branch 1: Detect TFTP server process activity on Falcon-protected hosts
// (unusual TFTP server startup or unexpected TFTP daemon launch)
(
  #event_simpleName = "ProcessRollup2"
  AND (
    ImageFileName = /tftpd|atftpd|tftp-hpa|tftp-server|tftpboot/i
    OR CommandLine = /tftpd|atftpd|tftp-server|--tftp/i
  )
)
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])
| rename(field="@timestamp", as="event_time")
| eval indicator_type = "TFTP_SERVER_PROCESS"
| eval suspicion_score = 2

// Branch 2: Detect outbound TFTP (UDP/69) connections from Falcon hosts to network device IPs
// Indicates a host acting as TFTP server for network device firmware delivery
#event_simpleName = "NetworkConnectIP4"
LocalPort = 69 OR RemotePort = 69
| groupBy(
    [ComputerName, LocalIP, RemoteIP],
    function=[
      count(as=connection_count),
      selectLast([LocalPort, RemotePort, @timestamp])
    ]
  )
| eval protocol = "UDP/69_TFTP"
| eval indicator_type = "TFTP_NETWORK_CONNECTION"
| eval suspicion_score = if(connection_count > 10, 3, 2)
| table([ComputerName, LocalIP, RemoteIP, protocol, connection_count, indicator_type, suspicion_score])

// Branch 3: Detect syslog ingest (requires custom Cisco IOS syslog pipeline into LogScale)
// If Cisco IOS syslogs are forwarded into LogScale under a custom repository
#repo = "network-devices"
(
  message = /boot system tftp|config-register 0x2100|config-register 0x2102|config-register 0x2140|config-register 0x2142|tftpdnld/i
  OR (
    message = /tftp:\/\//i
    AND message = /\.bin|\.tar|\.pkg|\.img|c3750|c2960|c7200|catalyst|nexus/i
  )
  OR message = /SYS-5-RELOAD|SYS-5-RESTART|SYS-6-RELOAD|Reload requested/i
)
| eval indicator_type = case(
    message = /boot system tftp/i, "TFTP_BOOT_COMMAND",
    message = /config-register 0x2142/i, "ROMMON_BYPASS_REGISTER",
    message = /config-register 0x21/i, "TFTP_BOOT_REGISTER",
    message = /tftpdnld/i, "ROMMON_TFTP_DOWNLOAD",
    message = /SYS-5-RELOAD|SYS-5-RESTART|SYS-6-RELOAD|Reload requested/i, "DEVICE_RELOAD",
    message = /tftp:\/\//i, "TFTP_IMAGE_TRANSFER",
    *
  )
| eval suspicion_score = case(
    message = /boot system tftp|tftpdnld/i, 3,
    message = /config-register 0x2142/i, 2,
    message = /tftp:\/\//i, 2,
    *,
    1
  )
| groupBy(
    [host, indicator_type],
    function=[
      sum(suspicion_score, as=total_score),
      count(as=event_count),
      selectLast([message])
    ]
  )
| where total_score >= 2
| sort(total_score, order=desc)