Techniques › T1556.004 › AN0758
AN0758 Analytic 0758
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects unauthorized modification of network device authentication by correlating OS image file changes, checksum mismatches, or memory verification failures with anomalous authentication events. Focus is on behaviors where patched images introduce hardcoded passwords or bypass native authentication.</p>
- Detects
- T1556.004 Network Device Authentication
- Part of
- DET0272 Detect Modification of Network Device Authentication via Patched System Images
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkconfig | unexpected OS image file upload or modification events | DC0061 File Modification |
| network:auth | repeated successful authentications with previously unknown accounts or anomalous password acceptance | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BaselineChecksums | Trusted baseline cryptographic hashes for OS images, used to detect unauthorized modifications. |
AuthFailureThreshold | Threshold for correlating unusual authentication successes following failed attempts or unknown account use. |
VerificationInterval | Frequency of runtime OS image and memory integrity checks. |