Detect TFTP Boot in Splunk
Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with Modify System Image to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality.
MITRE ATT&CK
- Tactic
- Defense Evasion Persistence
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.005 TFTP Boot
- Canonical reference
- https://attack.mitre.org/techniques/T1542/005/
SPL Detection Query
| union
[search index=network sourcetype="cisco:ios" earliest=-7d
("boot system tftp" OR "config-register 0x2100" OR "config-register 0x2102" OR "config-register 0x2140" OR "config-register 0x2142" OR "tftpdnld")
| eval indicator_type="BOOT_CONFIG_CHANGE"
| eval tftp_server=coalesce(mvindex(split(message, "tftp://"), 1), "")
| eval tftp_server=mvindex(split(tftp_server, " "), 0)
| eval config_register=case(
match(message, "config-register 0x2100"), "0x2100_TFTP_BOOT",
match(message, "config-register 0x2102"), "0x2102_TFTP_BOOT",
match(message, "config-register 0x2140"), "0x2140_TFTP_BOOT",
match(message, "config-register 0x2142"), "0x2142_ROMMON_BYPASS",
true(), "N/A"
)
| eval suspicion_score=if(match(message, "boot system tftp"), 3,
if(match(message, "tftpdnld"), 3,
if(match(config_register, "0x2142"), 2, 1)))
| table _time, host, src_ip, message, indicator_type, tftp_server, config_register, suspicion_score]
[search index=network sourcetype="cisco:ios" earliest=-7d
("SYS-5-RELOAD" OR "SYS-5-RESTART" OR "SYS-6-RELOAD" OR "Reload requested" OR "reload in " OR "reload at ")
| eval indicator_type="RELOAD_EVENT"
| eval suspicion_score=1
| table _time, host, src_ip, message, indicator_type, suspicion_score]
[search index=network (sourcetype="cisco:ios" OR sourcetype=syslog) earliest=-7d
("TFTP" OR "tftp://") (".bin" OR ".tar" OR ".pkg" OR ".img" OR "c3750" OR "c2960" OR "c7200" OR "asr" OR "isr" OR "catalyst" OR "nexus")
| eval indicator_type="TFTP_IMAGE_TRANSFER"
| eval tftp_server=coalesce(mvindex(split(message, "tftp://"), 1), "")
| eval tftp_server=mvindex(split(tftp_server, " "), 0)
| eval suspicion_score=2
| table _time, host, src_ip, message, indicator_type, tftp_server, suspicion_score]
| stats
sum(suspicion_score) as total_score,
values(indicator_type) as indicators,
values(tftp_server) as tftp_servers,
values(config_register) as config_registers,
count as event_count,
earliest(_time) as first_seen,
latest(_time) as last_seen
by host
| where total_score >= 2
| eval risk_level=case(
total_score >= 5, "CRITICAL",
total_score >= 3, "HIGH",
total_score >= 2, "MEDIUM",
true(), "LOW"
)
| eval has_tftp_and_reload=if(mvcount(mvfilter(match(indicators, "TFTP_IMAGE_TRANSFER"))) > 0 AND mvcount(mvfilter(match(indicators, "RELOAD_EVENT"))) > 0, 1, 0)
| sort - total_score
| table host, risk_level, total_score, indicators, tftp_servers, config_registers, event_count, first_seen, last_seen, has_tftp_and_reloadDetects TFTP Boot (T1542.005) using Cisco IOS syslog data in Splunk. Correlates three indicator categories across the cisco:ios and syslog sourcetypes: (1) boot configuration changes including 'boot system tftp' commands and suspicious config-register values, (2) TFTP image transfer events referencing known IOS image naming patterns, and (3) device reload events. Assigns a composite suspicion score per device — score >= 2 triggers alert. The has_tftp_and_reload field flags the highest-confidence scenario where an image transfer precedes a reload. Requires Cisco IOS syslog forwarding with the Splunk Add-on for Cisco IOS.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate network operations teams performing scheduled IOS upgrades via TFTP from authorized network management servers
- Password recovery procedures requiring config-register 0x2142 — always validate against change management tickets
- Lab or test environment provisioning where TFTP netbooting is intentionally used for device imaging
- Automated configuration management platforms pushing boot system commands as part of device hardening baselines
- Network device replacement/RMA procedures where a new device is imaged via TFTP before production deployment
Other platforms for T1542.005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Current Boot System Configuration on Cisco IOS Device
Expected signal: TACACS+/RADIUS authentication log entry for the SSH login from the test source IP to the device management IP. Cisco IOS syslog SYS-5-CONFIG_I is NOT generated for show commands. AAA accounting records (if enabled) will show 'show version', 'show bootvar', 'show running-config' commands. In Sentinel: Syslog table entries for the authentication event from the device. In Splunk: cisco:ios sourcetype entries for the AAA events.
- Test 2Add TFTP Boot System Command to Cisco IOS Configuration
Expected signal: Cisco IOS syslog event SYS-5-CONFIG_I: 'Configured from console by <user> on <interface>' — generated when running config is modified. The syslog message includes 'boot system tftp' and 'config-register 0x2100' in the config change context. TACACS+ accounting records will show the 'boot system tftp' and 'config-register' commands if command accounting is enabled. In Sentinel: Syslog table entries matching 'boot system tftp' and 'config-register 0x2100'. In Splunk: cisco:ios sourcetype entries triggering the BOOT_CONFIG_CHANGE indicator.
- Test 3Simulate TFTP Image Transfer to Network Device Management IP
Expected signal: Network flow data: UDP/69 traffic from the test source IP to <TFTP_SERVER_IP> with byte count matching the file size. Firewall logs: connection entries for UDP/69. If the TFTP server forwards to syslog: TFTPD transfer completion messages including filename 'c3750e-universalk9-mz.152-4.E10.bin'. In Sentinel: CommonSecurityLog entries for the TFTP connection if firewall forwards to Sentinel. In Splunk: network sourcetype entries for the UDP/69 flows triggering the TFTP_IMAGE_TRANSFER indicator.
- Test 4Trigger Device Reload After TFTP Configuration (Highest-Fidelity Composite Test)
Expected signal: Cisco IOS syslog: SYS-5-CONFIG_I for the boot system/config-register changes, followed by SYS-5-RELOAD 'Reload requested by <user>' and SYS-5-RELOAD 'Reload scheduled in 5 minutes'. After reload: SYS-5-RESTART 'System restarted'. In Sentinel: Syslog table captures all events; the CorrelatedEvents subquery in the KQL detection fires because TFTPTransferEvents (boot system tftp) and ReloadEvents (SYS-5-RELOAD) appear within 120 minutes on the same device. In Splunk: has_tftp_and_reload=1 because both BOOT_CONFIG_CHANGE and RELOAD_EVENT indicator types appear for the same host within the transaction maxspan.
References (10)
- https://attack.mitre.org/techniques/T1542/005/
- https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#35
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#23
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#26
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-xe-3se-3850-cr-book/sec-s1-xe-3se-3850-cr-book_chapter_010.html
- https://www.cisco.com/c/en/us/products/security/ios-trustworthy-systems.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1542.005/T1542.005.md
Unlock Pro Content
Get the full detection package for T1542.005 including response playbook, investigation guide, and atomic red team tests.