AN0497
Analytic 0497
Network Devices
Detection of anomalous ROMMON image changes or upgrades, unexpected reboots following firmware updates, and unauthorized use of firmware upgrade commands or TFTP transfers. Correlation of config modification, privilege escalation, and boot cycle anomalies provides visibility into ROMMON tampering attempts.
networkdevice:config
Log entries indicating ROMMON image upgrade commands (boot system, upgrade rom-monitor)
networkdevice:syslog
Unexpected reload, crashinfo, or boot message not tied to scheduled maintenance
NSM:Flow
Outbound or inbound TFTP file transfers of ROMMON or firmware binaries
[ApprovedROMMONVersions]
Baseline ROMMON image versions authorized for the environment
[TimeWindow]
Correlation window between ROMMON update command, TFTP file transfer, and device reboot
[AdminUserContext]
Expected privileged accounts allowed to execute ROMMON upgrade commands