{"id":"T1602","name":"Data from Configuration Repository","url":"https://attack.mitre.org/techniques/T1602","tactics":["collection"],"platforms":["Network Devices"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0592","stix_id":"x-mitre-detection-strategy--ff993025-1f12-486f-936f-6cc563050278","name":"Detection Strategy for Data from Configuration Repository on Network Devices","url":"https://attack.mitre.org/detectionstrategies/DET0592","analytics":[{"id":"AN1630","stix_id":"x-mitre-analytic--c5544183-4868-4a5c-ad8c-8a9359358298","name":"Analytic 1630","description":"Defenders may observe adversary attempts to extract configuration data from management repositories by monitoring for anomalous SNMP queries, API calls, or protocol requests (e.g., NETCONF, RESTCONF) that enumerate system configuration. Suspicious sequences include repeated queries from untrusted IPs, abnormal query types requesting sensitive configuration data, or repository access occurring outside of normal administrative maintenance windows. Abnormal authentication attempts, sudden enumeration of device inventory, or bulk data transfer of configuration files may also be observed.","url":"https://attack.mitre.org/detectionstrategies/DET0592#AN1630","platforms":["Network Devices"],"log_source_references":[{"name":"NSM:Flow","channel":"Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"},{"name":"networkdevice:syslog","channel":"Authentication failures or unusual community string usage in SNMP queries","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"AuthorizedAdminIPs","description":"Expected IP ranges or hosts permitted to query configuration repositories; deviations may indicate compromise."},{"field":"NormalAccessTimeWindow","description":"Time periods when configuration queries normally occur; anomalies outside these windows may be suspicious."},{"field":"QueryVolumeThreshold","description":"Number of queries allowed within a given period before an anomaly is triggered."},{"field":"ProtocolUsageBaseline","description":"Expected usage of SNMP, NETCONF, or RESTCONF; deviations from baseline patterns may indicate misuse."}],"live":true,"detection_strategies":["DET0592"],"techniques":["T1602"]}],"live":true,"version":"1.0","techniques":["T1602"]}],"sigma_rules":[],"kev_cves":[{"cveID":"CVE-2025-31324","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}