T1602.002 — Network Device Configuration Dump

Tactic: Collection · Platforms: Network Devices

Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating,…

Sub-technique of Data from Configuration Repository (T1602).

Sigma detection rules (1)

T1602.002 Data from Configuration Repository: Network Device Configuration Dump

title: "T1602.002 Data from Configuration Repository: Network Device Configuration Dump"
id: dc475911-4a6c-41c9-8116-0c09fa37e61c
description: 'Detection Strategy for Network Device Configuration Dump via Config Repositories. Dropped the plain ssh connect selector, which made the rule tautological/overly broad since SSH is used for virtually all routine remote administration and none of the selectors confirmed an actual config file was retrieved; the tftp/snmp indicators remain since they are genuinely specific to config-dump activity. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: AuthorizedAdminIPs, NormalConfigExportRate, AllowedTransferProtocols, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1602/002
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.collection
  - attack.t1602.002

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection_tftp:
    type: SYSCALL
    syscall: connect
    exe|endswith: '/tftp'
  selection_snmp:
    type: SYSCALL
    syscall: connect
    exe|endswith:
      - '/snmpwalk'
      - '/snmpget'

  condition: 1 of selection_*

falsepositives:
  - Legitimate network engineers pulling device backups via TFTP or SNMP polling for monitoring; auditd SYSCALL records do not expose the destination device IP or the specific config-dump command run over the session, so this only flags the responsible binary connecting out, not the actual authentication or dump event.

level: low

Related sub-techniques

Explore