tfMITRE ATT&CK technique

Data from Configuration Repository T1602

Tactic: Collection
Platform: Network Devices
Version: 1.1
Created: 19 October 2020
Last modified: 24 October 2025

Sub-techniques 20 rules across the family · 0 mapped directly to T1602 · 0 of 2 carry rules

.001SNMP (MIB Dump)0 .002Network Device Configuration Dump0

Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1602

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Data from Configuration Repository detection strategy DET0592

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Data from Configuration Repository on Network Devices

Enterprise

1 platform

AN1630 · Network Devices

Defenders may observe adversary attempts to extract configuration data from management repositories by monitoring for anomalous SNMP queries, API calls, or protocol requests (e.g., NETCONF, RESTCONF) that enumerate system configuration. Suspicious sequences include repeated queries from untrusted IPs, abnormal query types requesting sensitive configuration data, or repository access occurring outside of normal administrative maintenance windows. Abnormal authentication attempts, sudden enumeration of device inventory, or bulk data transfer of configuration files may also be observed.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	NSM:Flow	Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services
Network Traffic ContentDC0085	networkdevice:syslog	Authentication failures or unusual community string usage in SNMP queries

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthorizedAdminIPs	Expected IP ranges or hosts permitted to query configuration repositories; deviations may indicate compromise.
NormalAccessTimeWindow	Time periods when configuration queries normally occur; anomalies outside these windows may be suspicious.
QueryVolumeThreshold	Number of queries allowed within a given period before an anomaly is triggered.
ProtocolUsageBaseline	Expected usage of SNMP, NETCONF, or RESTCONF; deviations from baseline patterns may indicate misuse.

Data from Configuration Repository detections T1602

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs