AN1570
Analytic 1570
Network Devices
Defenders may observe adversary attempts to downgrade system images by monitoring for anomalous file transfers of OS image files (via TFTP, FTP, SCP), configuration changes pointing boot system variables to older image files, unexpected OS version strings after reboot, and checksum mismatches against approved baseline images. Suspicious chains include transfer of an older image, alteration of boot configuration, and reboot/reload of the device. Adversaries may also tamper with CLI output to disguise downgrade attempts, requiring independent validation of OS version and integrity.
networkdevice:cli
Execution of commands such as 'copy tftp flash', 'boot system <image>', 'reload'
networkdevice:config
Configuration changes referencing older image versions or unexpected boot parameters
networkdevice:syslog
OS version query results inconsistent with expected or approved version list
[ApprovedFirmwareVersions]
Whitelist of supported and validated OS versions for devices; helps reduce false positives.
[ChecksumBaseline]
Baseline cryptographic hashes of valid OS images; deviations indicate possible downgrade or tampering.
[TimeWindow]
Correlation period to detect the chain of file transfer → boot config change → reboot event.
[AuthorizedAdminAccounts]
Accounts authorized to perform OS upgrades/downgrades; anomalies suggest misuse or compromise.