{
  "node_id": "mitre-attack-t1542-005-tftp-boot",
  "title": "MITRE ATT&CK T1542.005: TFTP Boot (Enterprise Tactic TA0005 - Defense Evasion / TA0003 - Persistence)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-05-25",
  "bluf": "MITRE ATT&CK T1542.005 (TFTP Boot) is an Enterprise Defense Evasion and Persistence sub-technique of T1542 (Pre-OS Boot). Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Affected platforms: Network. MITRE-documented mitigations include M1031 Network Intrusion Prevention, M1028 Operating System Configuration, M1026 Privileged Account Management, M1035 Limit Access to Resource Over Network, M1047 Audit, M1046 Boot Integrity. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, CA-07, CM-02, CM-03, CM-05.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-cybersecurity-framework-2-0",
    "iso-27001-2022",
    "nist-sp-800-53-r5",
    "cis-controls-v8",
    "mitre-attack-t1542-pre-os-boot"
  ],
  "primary_citations_count": 7
}