T1556.004 — Network Device Authentication

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: Network Devices

Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. Modify System Image may include implanted code to the operating system for network devices to provide access for…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (1)

T1556.004 Modify Authentication Process: Network Device Authentication

title: "T1556.004 Modify Authentication Process: Network Device Authentication"
id: aca6f4dc-c93d-42b9-ab18-a84e58aa9388
description: 'Detect Modification of Network Device Authentication via Patched System Images. (Data Component: File Modification; baseline tier: fallback.) Tune using: BaselineChecksums, AuthFailureThreshold, VerificationInterval.'
references:
  - https://attack.mitre.org/techniques/T1556/004
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.004

logsource:
  category: file_change
  product: networkconfig

detection:
  selection_auth_change:
    Message|contains:
      - 'aaa authentication'
      - 'aaa authorization'
      - 'tacacs-server'
      - 'radius-server'
      - 'set system login'
  selection_removal:
    Message|contains:
      - 'no aaa'
      - 'no tacacs-server'
      - 'no radius-server'
      - 'delete system login'
  condition: 1 of selection_*

falsepositives:
  - Planned migration between authentication servers or a scheduled AAA configuration refresh by network operations.

level: high

Related sub-techniques

Explore