LoFP / generally used to copy configs or ios images

Techniques

• t1074
• t1105
• t1560
• t1560.001

Sample rules

Cisco Stage Data

• source: sigma
• technicques:
  • t1074
  • t1105
  • t1560
  • t1560.001

Description

Various protocols maybe used to put data on the device for exfil or infil

Detection logic

condition: keywords
keywords:
- tftp
- rcp
- puts
- copy
- configure replace
- archive tar