T1601.001 — Patch System Image

Tactic: Defense Impairment · Platforms: Network Devices

Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses. Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file.…

Sub-technique of Modify System Image (T1601).

Sigma detection rules (1)

T1601.001 Modify System Image: Patch System Image

title: "T1601.001 Modify System Image: Patch System Image"
id: abc1897b-9305-4ff8-8a7f-6aecf2a992f7
description: 'Detection Strategy for Patch System Image on Network Devices. T1601.001 describes patching the monolithic operating-system image of a network appliance (e.g. Cisco IOS/Junos) via TFTP/FTP/console transfer or ROMMON/bootloader memory patching -- this activity happens on the network device''s own management plane and firmware, which auditd on a general-purpose Linux host cannot observe at all; the previous version watched routine Linux kernel/initramfs file writes on the host itself, which is ordinary OS patching, not network-appliance firmware modification, and was NOT a valid proxy for this technique. This technique is genuinely not directly observable via Linux host auditd telemetry. The closest defensible Linux-observable proxy implemented here is: a Linux host acting as a staging/jump box executing tftp/ftp/scp/curl/wget to transfer firmware-image-like files (by extension/keyword) toward network infrastructure -- this only indicates file staging/transfer activity, not that any device image was actually patched, and should be treated as a weak, indirect indicator. (Data Component: Command Execution; baseline tier: fallback.) Tune using: ApprovedFirmwareVersions, AuthorizedAdminAccounts, ChecksumBaseline, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1601/001
author: Shahrukh Khan
date: 2026-03-09
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1601.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_transfer_tool:
    type: EXECVE
    a0|endswith:
      - '/tftp'
      - '/ftp'
      - '/scp'
      - '/curl'
      - '/wget'
  selection_image_like_arg:
    a1|contains:
      - '.bin'
      - '.img'
      - 'ios.'
      - 'firmware'

  condition: selection_transfer_tool and selection_image_like_arg

falsepositives:
  - Legitimate network-operations staff regularly stage and push approved firmware/IOS images from a jump host during authorized maintenance windows; this indicator cannot distinguish authorized firmware upgrades from malicious image patching and does not run on the network device itself, so it is a weak, indirect signal at best.

level: low

Related sub-techniques

Explore