TFTP Firmware Upload - Possible Firmware Corruption
This rule detects a TFTP (Trivial File Transfer Protocol) firmware upload attempt where the data size is greater than 10000 bytes. This could indicate an attempt to corrupt or replace the firmware on a device, potentially leading to denial of service or unauthorized control. The rule specifically looks for UDP traffic on port 69 (TFTP) with a specific content pattern and a large data size.
Suricata
