tfMITRE ATT&CK technique

Data from Configuration Repository T1602

Tactic: Collection
Platform: Network Devices
Version: 1.1
Created: 19 October 2020
Last modified: 24 October 2025

Sub-techniques 20 rules across the family · 0 mapped directly to T1602 · 0 of 2 carry rules

.001SNMP (MIB Dump)0 .002Network Device Configuration Dump0

Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Offense vs defense T1602

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Network Connection CreationDC0082	NSM:Flow	Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services
Network Traffic ContentDC0085	networkdevice:syslog	Authentication failures or unusual community string usage in SNMP queries

Data component

Name

Channel

Network Connection CreationDC0082

NSM:Flow

Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services

Network Traffic ContentDC0085

networkdevice:syslog

Authentication failures or unusual community string usage in SNMP queries

Field	What you tune
AuthorizedAdminIPs	Expected IP ranges or hosts permitted to query configuration repositories; deviations may indicate compromise.
NormalAccessTimeWindow	Time periods when configuration queries normally occur; anomalies outside these windows may be suspicious.
QueryVolumeThreshold	Number of queries allowed within a given period before an anomaly is triggered.
ProtocolUsageBaseline	Expected usage of SNMP, NETCONF, or RESTCONF; deviations from baseline patterns may indicate misuse.

Field

What you tune

AuthorizedAdminIPs

Expected IP ranges or hosts permitted to query configuration repositories; deviations may indicate compromise.

NormalAccessTimeWindow

Time periods when configuration queries normally occur; anomalies outside these windows may be suspicious.

QueryVolumeThreshold

Number of queries allowed within a given period before an anomaly is triggered.

ProtocolUsageBaseline

Expected usage of SNMP, NETCONF, or RESTCONF; deviations from baseline patterns may indicate misuse.

Offense vs defense T1602

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Network Connection CreationDC0082	NSM:Flow	Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services
Network Traffic ContentDC0085	networkdevice:syslog	Authentication failures or unusual community string usage in SNMP queries

Data component

Name

Channel

Network Connection CreationDC0082

NSM:Flow

Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services

Network Traffic ContentDC0085

networkdevice:syslog

Authentication failures or unusual community string usage in SNMP queries

Field	What you tune
AuthorizedAdminIPs	Expected IP ranges or hosts permitted to query configuration repositories; deviations may indicate compromise.
NormalAccessTimeWindow	Time periods when configuration queries normally occur; anomalies outside these windows may be suspicious.
QueryVolumeThreshold	Number of queries allowed within a given period before an anomaly is triggered.
ProtocolUsageBaseline	Expected usage of SNMP, NETCONF, or RESTCONF; deviations from baseline patterns may indicate misuse.

Field

What you tune

AuthorizedAdminIPs

Expected IP ranges or hosts permitted to query configuration repositories; deviations may indicate compromise.

NormalAccessTimeWindow

Time periods when configuration queries normally occur; anomalies outside these windows may be suspicious.

QueryVolumeThreshold

Number of queries allowed within a given period before an anomaly is triggered.

ProtocolUsageBaseline

Expected usage of SNMP, NETCONF, or RESTCONF; deviations from baseline patterns may indicate misuse.

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Title

Description

Data from Configuration Repository T1602

Data from Configuration Repository T1602

Offense vs defense T1602

Data from Configuration Repository detection strategy DET0592

Detection Strategy for Data from Configuration Repository on Network Devices

Log sources

Tunable fields

Offense vs defense T1602

Data from Configuration Repository detection strategy DET0592

Detection Strategy for Data from Configuration Repository on Network Devices

Log sources

Tunable fields

Data from Configuration Repository detections T1602

Data from Configuration Repository detections T1602