Techniques › T1602 › AN1630
AN1630 Analytic 1630
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders may observe adversary attempts to extract configuration data from management repositories by monitoring for anomalous SNMP queries, API calls, or protocol requests (e.g., NETCONF, RESTCONF) that enumerate system configuration. Suspicious sequences include repeated queries from untrusted IPs, abnormal query types requesting sensitive configuration data, or repository access occurring outside of normal administrative maintenance windows. Abnormal authentication attempts, sudden enumeration of device inventory, or bulk data transfer of configuration files may also be observed.</p>
- Detects
- T1602 Data from Configuration Repository
- Part of
- DET0592 Detection Strategy for Data from Configuration Repository on Network Devices
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| NSM:Flow | Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services | DC0082 Network Connection Creation |
| networkdevice:syslog | Authentication failures or unusual community string usage in SNMP queries | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedAdminIPs | Expected IP ranges or hosts permitted to query configuration repositories; deviations may indicate compromise. |
NormalAccessTimeWindow | Time periods when configuration queries normally occur; anomalies outside these windows may be suspicious. |
QueryVolumeThreshold | Number of queries allowed within a given period before an anomaly is triggered. |
ProtocolUsageBaseline | Expected usage of SNMP, NETCONF, or RESTCONF; deviations from baseline patterns may indicate misuse. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2025-31324 | SAP NetWeaver | Mapped |