tfMITRE ATT&CK sub-technique

Network Device Configuration Dump T1602.002

sub-technique of T1602 Data from Configuration Repository

Tactic: Collection
Platform: Network Devices
Version: 1.1
Created: 20 October 2020
Last modified: 12 May 2026

Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Network Device Configuration Dump MITRE reference T1602.002

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Salt TyphoonG1045 ↗

Has attempted to acquire credentials by dumping network device configurations.1

created 2025-02-241 reference

All 1 groups for this technique

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

GlassWormS9010 ↗

Has gathered data pertaining to VPN configurations.1 2 GlassWorm has also targeted locally stored data on macOS located in /Library/Application Support/Fortinet/FortiClient/conf/vpn.plist.2

created 2026-04-10MALWARE

All 1 software entries for this technique

Offense vs defense T1602.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Network Device Configuration Dump detection strategy DET0233

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Network Device Configuration Dump via Config Repositories

Enterprise

1 platform

AN0647 · Network Devices

Defenders may observe adversary attempts to collect or export full device configurations by detecting unusual SNMP queries, Smart Install (SMI) activity, or CLI/API commands that request running or startup configuration dumps. Correlated behaviors include high-volume read requests for sensitive OIDs, repeated use of 'show running-config' or equivalent commands from untrusted IPs, or unexpected TFTP/SCP/FTP transfers containing configuration files. These behaviors often appear in sequence: anomalous authentication or privilege escalation, followed by bulk configuration retrieval and outbound transfer.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	networkdevice:syslog	Failed and successful logins to network devices outside approved admin IP ranges
Command ExecutionDC0064	networkdevice:cli	Execution of commands like 'show running-config', 'copy running-config', or 'export config'
Network Connection CreationDC0082	snmp:access	GETBULK/GETNEXT requests for OIDs associated with configuration parameters
Network Traffic ContentDC0085	NSM:Flow	Outbound SCP, TFTP, or FTP sessions carrying configuration file content

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthorizedAdminIPs	Known trusted IP addresses permitted to execute configuration dump commands.
NormalConfigExportRate	Baseline frequency of legitimate configuration exports; anomalies above threshold may indicate malicious activity.
AllowedTransferProtocols	Expected transfer methods (e.g., SCP vs. TFTP). Unexpected use of weak protocols may indicate exfiltration.
TimeWindow	Normal maintenance windows for authorized configuration exports; activity outside these windows may be suspicious.

Network Device Configuration Dump detections T1602.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs