Techniques › T1602.002 › AN0647
AN0647 Analytic 0647
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders may observe adversary attempts to collect or export full device configurations by detecting unusual SNMP queries, Smart Install (SMI) activity, or CLI/API commands that request running or startup configuration dumps. Correlated behaviors include high-volume read requests for sensitive OIDs, repeated use of 'show running-config' or equivalent commands from untrusted IPs, or unexpected TFTP/SCP/FTP transfers containing configuration files. These behaviors often appear in sequence: anomalous authentication or privilege escalation, followed by bulk configuration retrieval and outbound transfer.</p>
- Detects
- T1602.002 Network Device Configuration Dump
- Part of
- DET0233 Detection Strategy for Network Device Configuration Dump via Config Repositories
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:syslog | Failed and successful logins to network devices outside approved admin IP ranges | DC0002 User Account Authentication |
| networkdevice:cli | Execution of commands like 'show running-config', 'copy running-config', or 'export config' | DC0064 Command Execution |
| NSM:Flow | Outbound SCP, TFTP, or FTP sessions carrying configuration file content | DC0085 Network Traffic Content |
| snmp:access | GETBULK/GETNEXT requests for OIDs associated with configuration parameters | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedAdminIPs | Known trusted IP addresses permitted to execute configuration dump commands. |
NormalConfigExportRate | Baseline frequency of legitimate configuration exports; anomalies above threshold may indicate malicious activity. |
AllowedTransferProtocols | Expected transfer methods (e.g., SCP vs. TFTP). Unexpected use of weak protocols may indicate exfiltration. |
TimeWindow | Normal maintenance windows for authorized configuration exports; activity outside these windows may be suspicious. |