tfMITRE ATT&CK sub-technique

Downgrade System Image T1601.002

sub-technique of T1601 Modify System Image

Tactic: Defense Impairment
Platform: Network Devices
Version: 2.0
Created: 19 October 2020
Last modified: 12 May 2026

Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. [1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1601.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Downgrade System Image detection strategy DET0569

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Downgrade System Image on Network Devices

Enterprise

1 platform

AN1570 · Network Devices

Defenders may observe adversary attempts to downgrade system images by monitoring for anomalous file transfers of OS image files (via TFTP, FTP, SCP), configuration changes pointing boot system variables to older image files, unexpected OS version strings after reboot, and checksum mismatches against approved baseline images. Suspicious chains include transfer of an older image, alteration of boot configuration, and reboot/reload of the device. Adversaries may also tamper with CLI output to disguise downgrade attempts, requiring independent validation of OS version and integrity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File MetadataDC0059	networkdevice:syslog	OS version query results inconsistent with expected or approved version list
File ModificationDC0061	networkdevice:config	Configuration changes referencing older image versions or unexpected boot parameters
Command ExecutionDC0064	networkdevice:cli	Execution of commands such as 'copy tftp flash', 'boot system <image>', 'reload'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedFirmwareVersions	Whitelist of supported and validated OS versions for devices; helps reduce false positives.
ChecksumBaseline	Baseline cryptographic hashes of valid OS images; deviations indicate possible downgrade or tampering.
TimeWindow	Correlation period to detect the chain of file transfer → boot config change → reboot event.
AuthorizedAdminAccounts	Accounts authorized to perform OS upgrades/downgrades; anomalies suggest misuse or compromise.

Downgrade System Image detections T1601.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs