Detect TFTP Boot in Sumo Logic CSE
Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with Modify System Image to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality.
MITRE ATT&CK
- Tactic
- Defense Evasion Persistence
- Technique
- T1542 Pre-OS Boot
- Sub-technique
- T1542.005 TFTP Boot
- Canonical reference
- https://attack.mitre.org/techniques/T1542/005/
Sumo Detection Query
// Part 1: TFTP boot configuration changes and ROMMON manipulation
(_sourceCategory=network/cisco/ios OR _sourceCategory=network/syslog)
| where (%"cisco.ios" or sourceName matches /cisco/i or _collector matches /network/i)
| where message matches /boot system tftp|config-register 0x2100|config-register 0x2102|config-register 0x2140|config-register 0x2142|tftpdnld/i
| parse field=message "tftp://" nodrop
| parse regex field=message "tftp://(?P<tftp_server>[\d\.]+)" nodrop
| eval indicator_type = if(message matches /boot system tftp/i, "TFTP_BOOT_COMMAND",
if(message matches /config-register 0x2142/i, "ROMMON_BYPASS_REGISTER",
if(message matches /config-register 0x21/i, "TFTP_BOOT_REGISTER",
if(message matches /tftpdnld/i, "ROMMON_TFTP_DOWNLOAD", "BOOT_CONFIG"))))
| eval suspicion_score = if(message matches /boot system tftp/i, 3,
if(message matches /tftpdnld/i, 3,
if(message matches /config-register 0x2142/i, 2, 1)))
| fields _messageTime, _sourceHost, indicator_type, tftp_server, suspicion_score, message
// Part 2 (run separately): TFTP image transfer events
(_sourceCategory=network/cisco/ios OR _sourceCategory=network/syslog)
| where (message matches /tftp:\/\//i or message matches /TFTP/)
| where (message matches /\.bin|\.tar|\.pkg|\.img|c3750|c2960|c7200|asr|isr|catalyst|nexus/i)
| parse regex field=message "tftp://(?P<tftp_server>[\d\.]+)" nodrop
| eval indicator_type = "TFTP_IMAGE_TRANSFER"
| eval suspicion_score = 2
| fields _messageTime, _sourceHost, indicator_type, tftp_server, suspicion_score, message
// Part 3 (run separately): Reload events — join with above in Sumo CIP or Scheduled Search
(_sourceCategory=network/cisco/ios OR _sourceCategory=network/syslog)
| where message matches /SYS-5-RELOAD|SYS-5-RESTART|SYS-6-RELOAD|Reload requested|reload in |reload at /i
| eval indicator_type = "RELOAD_EVENT"
| eval suspicion_score = 1
| fields _messageTime, _sourceHost, indicator_type, suspicion_score, messageDetects TFTP Boot abuse (T1542.005) across three Sumo Logic search branches: (1) boot system TFTP commands and ROMMON register manipulation in Cisco IOS syslog, (2) TFTP image transfer events containing known Cisco platform firmware file patterns, and (3) device reload events that can be correlated temporally with TFTP activity using a scheduled search or lookup.
Data Sources
Required Tables
False Positives & Tuning
- Planned network device OS upgrades using TFTP as the transfer mechanism — common in enterprises still relying on TFTP for image distribution
- Network device bootstrap provisioning using TFTP (Zero Touch Provisioning or PnP) for new hardware deployment
- Security assessment or penetration testing activities specifically targeting network infrastructure with authorization
Other platforms for T1542.005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Current Boot System Configuration on Cisco IOS Device
Expected signal: TACACS+/RADIUS authentication log entry for the SSH login from the test source IP to the device management IP. Cisco IOS syslog SYS-5-CONFIG_I is NOT generated for show commands. AAA accounting records (if enabled) will show 'show version', 'show bootvar', 'show running-config' commands. In Sentinel: Syslog table entries for the authentication event from the device. In Splunk: cisco:ios sourcetype entries for the AAA events.
- Test 2Add TFTP Boot System Command to Cisco IOS Configuration
Expected signal: Cisco IOS syslog event SYS-5-CONFIG_I: 'Configured from console by <user> on <interface>' — generated when running config is modified. The syslog message includes 'boot system tftp' and 'config-register 0x2100' in the config change context. TACACS+ accounting records will show the 'boot system tftp' and 'config-register' commands if command accounting is enabled. In Sentinel: Syslog table entries matching 'boot system tftp' and 'config-register 0x2100'. In Splunk: cisco:ios sourcetype entries triggering the BOOT_CONFIG_CHANGE indicator.
- Test 3Simulate TFTP Image Transfer to Network Device Management IP
Expected signal: Network flow data: UDP/69 traffic from the test source IP to <TFTP_SERVER_IP> with byte count matching the file size. Firewall logs: connection entries for UDP/69. If the TFTP server forwards to syslog: TFTPD transfer completion messages including filename 'c3750e-universalk9-mz.152-4.E10.bin'. In Sentinel: CommonSecurityLog entries for the TFTP connection if firewall forwards to Sentinel. In Splunk: network sourcetype entries for the UDP/69 flows triggering the TFTP_IMAGE_TRANSFER indicator.
- Test 4Trigger Device Reload After TFTP Configuration (Highest-Fidelity Composite Test)
Expected signal: Cisco IOS syslog: SYS-5-CONFIG_I for the boot system/config-register changes, followed by SYS-5-RELOAD 'Reload requested by <user>' and SYS-5-RELOAD 'Reload scheduled in 5 minutes'. After reload: SYS-5-RESTART 'System restarted'. In Sentinel: Syslog table captures all events; the CorrelatedEvents subquery in the KQL detection fires because TFTPTransferEvents (boot system tftp) and ReloadEvents (SYS-5-RELOAD) appear within 120 minutes on the same device. In Splunk: has_tftp_and_reload=1 because both BOOT_CONFIG_CHANGE and RELOAD_EVENT indicator types appear for the same host within the transaction maxspan.
References (10)
- https://attack.mitre.org/techniques/T1542/005/
- https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#35
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#7
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#13
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#23
- https://tools.cisco.com/security/center/resources/integrity_assurance.html#26
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-xe-3se-3850-cr-book/sec-s1-xe-3se-3850-cr-book_chapter_010.html
- https://www.cisco.com/c/en/us/products/security/ios-trustworthy-systems.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1542.005/T1542.005.md
Unlock Pro Content
Get the full detection package for T1542.005 including response playbook, investigation guide, and atomic red team tests.