SNMP (MIB Dump), T1602.001, is a sub-technique of Data from Configuration Repository, in the collection tactic, for the Network Devices platform. The adversary reads the Management Information Base of devices managed with Simple Network Management Protocol.
How attackers use it
MITRE explains that the MIB is a configuration repository that stores variable information accessible through SNMP, in the form of object identifiers (OIDs). Each OID names a variable that can be read or set, which allows active management such as configuration changes through remote modification of those variables.
SNMP gives administrators insight into systems: system information, hardware descriptions, physical location, software packages. The MIB may also contain operational information such as the running configuration, routing table and interface details.
Adversaries may use SNMP queries to collect MIB content directly from managed devices in order to gather network information that lets them build network maps and prepare future targeted exploitation.
Notice that the same protocol that makes monitoring easy makes mapping easy. A device that answers SNMP queries from anywhere is answering the adversary too.
How to detect it
MITRE's detection strategy points to:
- Abnormal queries for large sets of OIDs.
- Repeated SNMP GETBULK or GETNEXT requests.
- Queries from non-administrative IP addresses.
- Unusual use of community strings, authentication failures, and enumeration outside maintenance windows.
Correlating syslog, NetFlow and SNMP audit data can reveal chains such as repeated authentication failures followed by a successful large-scale OID retrieval.
How to reduce the risk
MITRE lists:
- Software Configuration. Allowlist MIB objects and implement SNMP views, so a query can only read what you intend.
- Update Software. Keep images and software updated and migrate to SNMPv3.
- Encrypt Sensitive Information. Configure SNMPv3 with the highest security level available, authPriv.
- Network Intrusion Prevention. Detect SNMP queries and commands from unauthorized sources.
- Network Segmentation. Keep SNMP traffic on a separate management network.
Check your own environment
On a Cisco IOS device (read-only; confirm syntax for your platform):
show running-config | include snmp-server
show snmp user
Review the output:
- Are there default or guessable community strings?
- Is SNMPv3 with authentication and privacy in use?
- Is access limited to named management hosts?
Quick check
Which SNMPv3 level does MITRE recommend?
The highest available, authPriv, which provides authentication and encryption.
