Data from Configuration Repository
- ID
- T1602
- Tactics
- TA0009 Collection
- Platforms
- Network Devices
- Data sources
- Network Connection Creation, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.
Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.[2][1]
Sub-techniques (2)
Detection
- DET0592 Detection Strategy for Data from Configuration Repository on Network Devices
Data components: Network Connection Creation, Network Traffic Content
Mitigations (6)
- M1030 Network Segmentation
Segregate SNMP traffic on a separate management network.[1]
- M1031 Network Intrusion Prevention
Configure intrusion prevention devices to detect SNMP queries and commands from unauthorized sources.[2]
- M1037 Filter Network Traffic
Apply extended ACLs to block unauthorized protocols outside the trusted network.[1]
- M1041 Encrypt Sensitive Information
Configure SNMPv3 to use the highest level of security (authPriv) available.[1]
- M1051 Update Software
Keep system images and software updated and migrate to SNMPv3.[3]
- M1054 Software Configuration
Allowlist MIB objects and implement SNMP views.[4]
References
- US-CERT TA17-156A SNMP Abuse 2017
- US-CERT-TA18-106A
- Cisco Blog Legacy Device Attacks
- Cisco Securing SNMP