Pre-OS Boot: TFTP Boot T1542.005
Tactics: Stealth, Persistence
Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.
Authoring guide
These 1 rule share fields, values, and exclusions.
Fields filtered most (4 distinct)
These fields appear most often in rule filters.
Top indicator values (9 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Platform: Network
Domain: Network