Network Device Configuration Dump (T1602.002) is a sub-technique of Data from Configuration Repository, in the collection tactic, for the Network Devices platform. The adversary reads or exports the configuration file of a network device.
A configuration file is a map. It tells you what the device does, how the network around it is laid out, and sometimes who is allowed in.
How attackers use it
MITRE says network configuration files hold the parameters that determine how a device operates. A device usually keeps an in-memory copy while running and a separate copy in non-volatile storage that loads after a reset.
By inspecting those files, an adversary can learn about the target network and its layout, the device and its software, and legitimate accounts and credentials for later use.
The access tools are ordinary ones. MITRE names common management tools and protocols such as SNMP and Smart Install (SMI), which can be used to query specific data from a configuration repository or to make a device export its configuration for later analysis.
Smart Install is worth a second look in your own estate. It is a feature meant for convenient switch deployment, and if it is enabled but unused, it is simply an extra door.
How to detect it
MITRE's detection strategy points to several behaviors:
- Unusual SNMP queries.
- Smart Install activity.
- CLI or API commands requesting the running or startup configuration.
- High-volume read requests for sensitive OIDs.
- Repeated use of show running-config or an equivalent from untrusted IP addresses.
- Unexpected TFTP, SCP or FTP transfers that carry configuration files.
They often appear in sequence: abnormal authentication or privilege escalation, then bulk configuration retrieval, then an outbound transfer. Hunting for that sequence is more reliable than alerting on any one event.
Sources to collect include syslog from devices, NetFlow or other flow records, SNMP and API logs, and AAA accounting records of commands run.
A simple rule: any configuration transfer that was not started by your backup system or an authorized administrator is worth investigating.
How to reduce the risk
MITRE lists five mitigations.
- Encrypt Sensitive Information. Configure SNMPv3 with the highest level of security available, authPriv.
- Network Segmentation. Segregate SNMP traffic on a separate management network.
- Network Intrusion Prevention. Detect SNMP queries and commands from unauthorized sources, and create signatures to detect Smart Install use from sources other than the trusted director.
- Software Configuration. Allowlist MIB objects and implement SNMP views. Disable Smart Install if it is not used.
- Filter Network Traffic. Apply extended ACLs to block unauthorized protocols outside the trusted network.
Keep one more habit. Treat configuration backups with the same care as the devices. A backup server that anyone can read is another repository for the same data.
Check your own environment
On a Cisco IOS device (read-only; confirm syntax for your platform), check the Smart Install state and SNMP settings:
show vstack config
show tcp brief all
show running-config | include snmp-server
The Smart Install client listens on TCP port 4786, so look for that port in the second command's output. If Smart Install is on and you do not use it, turn it off through your normal change process.
Then ask:
- Which hosts are allowed to reach SNMP and Smart Install, and where is that written down?
- Who can read configuration backups?
- Do device configurations contain credentials in a form that is easy to reverse?
- Would you notice an unexpected TFTP transfer from a switch?
Quick check
Which two tools does MITRE name for obtaining device configurations?
SNMP and Smart Install (SMI).
What should you do about Smart Install if you do not use it?
Disable it, as MITRE recommends under Software Configuration.
