{"id":"T1602.002","name":"Network Device Configuration Dump","url":"https://attack.mitre.org/techniques/T1602/002","tactics":["collection"],"platforms":["Network Devices"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0233","stix_id":"x-mitre-detection-strategy--f3bc6ce9-29ad-4ad4-813c-1a4176b5c7a2","name":"Detection Strategy for Network Device Configuration Dump via Config Repositories","url":"https://attack.mitre.org/detectionstrategies/DET0233","analytics":[{"id":"AN0647","stix_id":"x-mitre-analytic--58e73108-657e-42ce-8dad-4edc968a2b20","name":"Analytic 0647","description":"Defenders may observe adversary attempts to collect or export full device configurations by detecting unusual SNMP queries, Smart Install (SMI) activity, or CLI/API commands that request running or startup configuration dumps. Correlated behaviors include high-volume read requests for sensitive OIDs, repeated use of 'show running-config' or equivalent commands from untrusted IPs, or unexpected TFTP/SCP/FTP transfers containing configuration files. These behaviors often appear in sequence: anomalous authentication or privilege escalation, followed by bulk configuration retrieval and outbound transfer.","url":"https://attack.mitre.org/detectionstrategies/DET0233#AN0647","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"Failed and successful logins to network devices outside approved admin IP ranges","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"networkdevice-syslog"},{"name":"networkdevice:cli","channel":"Execution of commands like 'show running-config', 'copy running-config', or 'export config'","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"},{"name":"NSM:Flow","channel":"Outbound SCP, TFTP, or FTP sessions carrying configuration file content","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"snmp:access","channel":"GETBULK/GETNEXT requests for OIDs associated with configuration parameters","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"snmp-access"}],"mutable_elements":[{"field":"AuthorizedAdminIPs","description":"Known trusted IP addresses permitted to execute configuration dump commands."},{"field":"NormalConfigExportRate","description":"Baseline frequency of legitimate configuration exports; anomalies above threshold may indicate malicious activity."},{"field":"AllowedTransferProtocols","description":"Expected transfer methods (e.g., SCP vs. TFTP). Unexpected use of weak protocols may indicate exfiltration."},{"field":"TimeWindow","description":"Normal maintenance windows for authorized configuration exports; activity outside these windows may be suspicious."}],"live":true,"detection_strategies":["DET0233"],"techniques":["T1602.002"]}],"live":true,"version":"1.0","techniques":["T1602.002"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}