T1601.002 — Downgrade System Image

T1601.002 Modify System Image: Downgrade System Image

title: "T1601.002 Modify System Image: Downgrade System Image"
id: fd9412d7-548d-4f45-bf43-aee7767993fc
description: 'Detection Strategy for Downgrade System Image on Network Devices. Genuine T1601.002 targets the OS or firmware image of a network device itself, and such embedded devices typically do not run Linux auditd at all; the previous dpkg -i and apt-get install version-pin selectors instead only detected ordinary Linux package downgrades on a general-purpose host, an unrelated behavior and telemetry class. Retargeted, for the case of a Linux-based jump host or an appliance that does run auditd, to firmware-file transfer (tftp, scp, curl, or wget pulling a file referencing firmware, .bin, or .img) and execution of a firmware-flashing utility (flashcp, flashrom, sysupgrade, or mtd_debug); coverage is inherently partial since most network appliances lack a full Linux audit subsystem. Tune using: ApprovedFirmwareVersions, ChecksumBaseline, TimeWindow, AuthorizedAdminAccounts.'
references:
  - https://attack.mitre.org/techniques/T1601/002
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1601.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_firmware_transfer:
    type: EXECVE
    exe|endswith:
      - '/tftp'
      - '/scp'
      - '/curl'
      - '/wget'
    a2|contains:
      - 'firmware'
      - '.bin'
      - '.img'
  selection_flash_tool:
    type: EXECVE
    exe|endswith:
      - '/flashcp'
      - '/flashrom'
      - '/sysupgrade'
      - '/mtd_debug'

  condition: 1 of selection_*

falsepositives:
  - Legitimate firmware upgrade/rollback procedures performed by network or system administrators using the same transfer and flashing utilities.

level: high