DRYHOOKS9013 ↗
Has patched victim appliances authentication routines to capture credentials in plaintext as users log in.1
tfMITRE ATT&CK sub-technique
Network Device Authentication T1556.004
sub-technique of T1556 Modify Authentication Process
- Platform
- Network Devices
- Version
- 3.0
- Created
- 19 October 2020
- Last modified
- 12 May 2026
Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Network Device Authentication MITRE reference T1556.004
57th pctamong all ATT&CK techniques for number of tools
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
SLOWPULSES1104 ↗
Can modify LDAP and two factor authentication flows by inspecting login credentials and forcing successful authentication if the provided password matches a chosen backdoor password.1
SYNful KnockS0519 ↗
Has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.1
All 3 software entries for this technique
Offense vs defense T1556.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1
first rule: 2025 Q4Network Device Authentication detection strategy DET0272
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Modification of Network Device Authentication via Patched System Images
1 platform
AN0758 · Network Devices
Detects unauthorized modification of network device authentication by correlating OS image file changes, checksum mismatches, or memory verification failures with anomalous authentication events. Focus is on behaviors where patched images introduce hardcoded passwords or bypass native authentication.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | network:auth | repeated successful authentications with previously unknown accounts or anomalous password acceptance |
| File ModificationDC0061 | networkconfig | unexpected OS image file upload or modification events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BaselineChecksums | Trusted baseline cryptographic hashes for OS images, used to detect unauthorized modifications. |
| AuthFailureThreshold | Threshold for correlating unusual authentication successes following failed attempts or unknown account use. |
| VerificationInterval | Frequency of runtime OS image and memory integrity checks. |
Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control.
Restrict administrator accounts to as few individuals as possible, following least privilege principles. Prevent credential overlap across systems of administrator and privileged accounts, particularly between network and non-network platforms, such as servers or endpoints.