T1602.001 — SNMP (MIB Dump)

Tactic: Collection · Platforms: Network Devices

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object…

Sub-technique of Data from Configuration Repository (T1602).

Sigma detection rules (1)

T1602.001 Data from Configuration Repository: SNMP (MIB Dump)

title: "T1602.001 Data from Configuration Repository: SNMP (MIB Dump)"
id: f550d12e-5743-4f30-a500-1d117bdacf5b
description: 'Detection Strategy for SNMP (MIB Dump) on Network Devices. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: AuthorizedAdminIPs, NormalSNMPQueryRate, CommunityStringPatterns, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1602/001
author: Shahrukh Khan
date: 2026-02-20
license: MIT
tags:
  - attack.collection
  - attack.t1602.001

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_snmp:
    Message|contains:
      - 'SNMP'
      - 'community string'
  selection_default_community:
    Message|contains:
      - 'public'
      - 'private'
  condition: selection_snmp and selection_default_community

falsepositives:
  - Legacy monitoring tools still configured with default community strings during a migration to SNMPv3.

level: high

Related sub-techniques

Explore