t1602-002-network-device-configuration-dump

name	T1602.002_network-device-configuration-dump
description	Adversaries may access network configuration files to collect sensitive data about the device and the network.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1602.002","collection","network-devices","sub-technique"]
technique_id	T1602.002
tactic	collection
all_tactics	["collection"]
platforms	["Network Devices"]
mitre_url	https://attack.mitre.org/techniques/T1602/002
tech_stack	["network devices"]
cwe_ids	["CWE-200"]
chains_with	["T1602","T1602.001"]
prerequisites	["T1602"]
severity_boost	{"T1602":"Chain with T1602 for deeper attack path","T1602.001":"Chain with T1602.001 for deeper attack path"}

T1602.002 Network Device Configuration Dump

Sub-technique of: T1602

High-Level Description

Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.

Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files. These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.

Kill Chain Phase

• Collection (TA0009)

Platforms: Network Devices

What to Check

• Identify if Network Device Configuration Dump technique is applicable to target environment
• Check Network Devices systems for indicators of Network Device Configuration Dump
• Verify mitigations are bypassed or absent (6 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Network Device Configuration Dump by examining the target platforms (Network Devices).

2. Assess Existing Defenses: Review whether mitigations for T1602.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1041 Encrypt Sensitive Information

Configure SNMPv3 to use the highest level of security (authPriv) available.