TFTP Bootloader File Request - Possible Pre-OS Persistence

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects TFTP (Trivial File Transfer Protocol) requests for bootloader files. Specifically, it looks for UDP traffic on port 69 (the standard TFTP port) where the packet content starts with the byte sequence "00 01". This pattern is characteristic of a TFTP read request for a file, often used in network booting scenarios to retrieve bootloader files. The rule flags this activity as a "Possible Pre-OS Persistence" mechanism, suggesting an adversary might be attempting to establish persistence before the operating system fully loads, potentially through techniques like bootkits or modifying boot records.