Data from Configuration Repository (T1602) is a collection technique in MITRE ATT&CK, for the Network Devices platform. The adversary pulls information from the systems that hold and distribute configuration for managed devices.
A configuration repository is a concentrated target. One place can describe dozens or thousands of devices, which is exactly why management systems exist and exactly why attackers want them.
How attackers use it
MITRE says configuration repositories are used by management systems to configure, manage and control data on remote systems, and may also help with remote access and administration of devices.
Adversaries may target these repositories to collect large quantities of sensitive system administration data. The data may be exposed through various protocols and software and can include a wide variety of details, much of which aligns with adversary discovery goals.
MITRE lists two sub-techniques:
- SNMP (MIB Dump), T1602.001
- Network Device Configuration Dump, T1602.002
How to detect it
MITRE's detection strategy is to watch for attempts to extract configuration data from management repositories by looking for:
- Anomalous SNMP queries, API calls or protocol requests, such as NETCONF or RESTCONF, that enumerate system configuration.
- Repeated queries from untrusted IP addresses.
- Unusual query types asking for sensitive configuration data.
- Repository access outside normal administrative maintenance windows.
Other signals include abnormal authentication attempts, sudden enumeration of device inventory, and bulk transfer of configuration files.
Sources to collect: device and management system logs, SNMP and API access logs, and network flow data that lets you see who talks to management ports.
How to reduce the risk
MITRE lists five mitigations.
- Update Software. Keep system images and software updated and migrate to SNMPv3.
- Software Configuration. Allowlist MIB objects and implement SNMP views.
- Network Segmentation. Segregate SNMP traffic on a separate management network.
- Filter Network Traffic. Apply extended ACLs to block unauthorized protocols outside the trusted network.
- Network Intrusion Prevention. Configure intrusion prevention devices to detect SNMP queries and commands from unauthorized sources.
Check your own environment
On a Cisco IOS device (read-only; confirm syntax for your platform):
show running-config | include snmp-server
Look for community strings, and for whether SNMPv3 is configured. Then ask:
- Which hosts are allowed to query SNMP, and is that enforced by ACL?
- Are device management interfaces reachable only from a management network?
- Are configuration backups stored in a place that needs authentication?
Quick check
Why do management repositories attract adversaries?
They hold large amounts of sensitive administration data about many devices in one place, which fits adversary discovery goals.
