DRYHOOKS9013 ↗
Has modified the Ivanti Connect Secure VPN authentication Perl module DSAuth.pm by reading its contents in the buffer, then finding and replacing select lines of code.12
tfMITRE ATT&CK technique
Modify System Image T1601
- Tactic
- Defense Impairment
- Platform
- Network Devices
- Version
- 2.0
- Created
- 19 October 2020
- Last modified
- 12 May 2026
Sub-techniques 21 rules across the family · 0 mapped directly to T1601 · 1 of 2 carry rules
Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Modify System Image MITRE reference T1601
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1601
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Modify System Image detection strategy DET0170
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Modify System Image on Network Devices
1 platform
AN0482 · Network Devices
Defenders may observe adversary attempts to alter or replace a network device’s operating system image through anomalous CLI commands, unexpected firmware updates, integrity check failures, or mismatches in version and checksum validation. Suspicious behavior includes modification of image files on storage, OS version output inconsistent with baselines, unexpected reloads or reboots after image replacement, and changes to boot configuration that load non-standard system images.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | networkdevice:config | Configuration changes to boot variables, startup image paths, or checksum verification failures |
| Command ExecutionDC0064 | networkdevice:cli | Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system') |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedAdminAccounts | Defines trusted administrator accounts allowed to modify system images; deviations indicate possible malicious modification. |
| ApprovedFirmwareVersions | Whitelist of validated vendor OS images; unexpected versions may suggest adversarial tampering. |
| TimeWindow | Correlation window for detecting config changes followed by firmware updates or reboots. |
| ChecksumBaseline | Baseline cryptographic hashes of approved system images; deviations may indicate compromise. |
Boot IntegrityM1046
Some vendors of embedded network devices provide cryptographic signing to ensure the integrity of operating system images at boot time. Implement where available, following vendor guidelines.
Code SigningM1045
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image.
Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats. Ensure that, where available, local passwords are always encrypted, per vendor recommendations.
Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control.
Password PoliciesM1027
Refer to NIST guidelines when creating password policies.
Restrict administrator accounts to as few individuals as possible, following least privilege principles. Prevent credential overlap across systems of administrator and privileged accounts, particularly between network and non-network platforms, such as servers or endpoints.