TFTP Pre-Boot File Transfer Detected
This rule detects multiple TFTP (Trivial File Transfer Protocol) transfers to port 69 on the home network within a short timeframe. Specifically, it triggers an alert if three or more TFTP transfers from the same source IP address occur within a 30-second window. This activity can be indicative of a Pre-Boot Execution Environment (PXE) boot process, which often uses TFTP to transfer boot files, or potentially malicious activity involving file transfers via TFTP.
Suricata
