{"id":"T1584.008","name":"Network Devices","url":"https://attack.mitre.org/techniques/T1584/008","tactics":["resource-development"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0859","stix_id":"x-mitre-detection-strategy--31fef61c-301b-4a3d-aced-06632e321926","name":"Detection of Network Devices","url":"https://attack.mitre.org/detectionstrategies/DET0859","analytics":[{"id":"AN1991","stix_id":"x-mitre-analytic--4384e648-0f49-442d-b989-6a47f2194130","name":"Analytic 1991","description":"Once adversaries leverage compromised network devices as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known.(Citation: ThreatConnect Infrastructure Dec 2020) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle. ","url":"https://attack.mitre.org/detectionstrategies/DET0859#AN1991","platforms":["PRE"],"log_source_references":[{"name":"Internet Scan","channel":"None","data_component":"DC0104","data_component_name":"Response Content","log_source_slug":"internet-scan"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0859"],"techniques":["T1584.008"]}],"live":true,"version":"1.0","techniques":["T1584.008"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}