T1602.002sub-technique of T1602 Data from Configuration Repository
Network Device Configuration Dump
Network Devicesnothing on this site yetT1602.002 on attack.mitre.org
Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Detection Strategy for Network Device Configuration Dump via Config Repositories
- Defenders may observe adversary attempts to collect or export full device configurations by detecting unusual SNMP queries, Smart Install (SMI) activity, or CLI/API commands that request running or startup configuration dumps.
what reduces it
- M1031 Network Intrusion Prevention. Configure intrusion prevention devices to detect SNMP queries and commands from unauthorized sources. Create signatures to detect Smart Install (SMI) usage from sources other than trusted director.
- M1037 Filter Network Traffic. Apply extended ACLs to block unauthorized protocols outside the trusted network.
- M1030 Network Segmentation. Segregate SNMP traffic on a separate management network.
- M1054 Software Configuration. Allowlist MIB objects and implement SNMP views. Disable Smart Install (SMI) if not used.
- M1051 Update Software. Keep system images and software updated and migrate to SNMPv3.
- M1041 Encrypt Sensitive Information. Configure SNMPv3 to use the highest level of security (authPriv) available.