T1542.005 — TFTP Boot

Tactics: Stealth, Persistence · Platforms: Network Devices

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management…

Sub-technique of Pre-OS Boot (T1542).

Sigma detection rules (1)

T1542.005 Pre-OS Boot: TFTP Boot

title: "T1542.005 Pre-OS Boot: TFTP Boot"
id: dc48612f-4ca2-4e79-96f1-c4a72b87736b
description: 'T1542.005 describes a network device''s management plane being reconfigured to netboot its OS/firmware image from a rogue TFTP server -- this reconfiguration and the subsequent netboot handshake happen on router/switch firmware and the pre-OS boot loader, entirely outside a Linux host''s kernel audit subsystem, so it is genuinely not observable via Linux auditd/syslog telemetry (the earlier rule''s "tftp ... get" process-execution check was really just generic TFTP file-transfer activity with no bearing on device boot images). As the closest defensible Linux-observable proxy -- for the case of a Linux box acting as the network-boot/TFTP server that supplies those images -- this rule instead watches for modification of local PXE/TFTP-netboot configuration (dnsmasq/tftpboot/xinetd tftp service config), which is how an adversary would tamper with a Linux-based netboot server to point devices at an unauthorized image. Tune using: ApprovedTFTPServers, TimeWindow, BaselineBootImageHash.'
references:
  - https://attack.mitre.org/techniques/T1542/005
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.t1542.005

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_path:
    type: PATH
    name|contains:
      - '/etc/dnsmasq.conf'
      - '/etc/dnsmasq.d/'
      - '/var/lib/tftpboot'
      - '/srv/tftp'
      - '/etc/xinetd.d/tftp'
  selection_write:
    nametype:
      - CREATE
      - NORMAL

  condition: selection_path and selection_write

falsepositives:
  - Legitimate administration of a PXE/TFTP netboot server infrastructure (adding/updating approved boot images or config); scope ApprovedTFTPServers/BaselineBootImageHash to confirm the referenced image matches an authorized hash.

level: medium

Related sub-techniques

Explore