TA0009 · COLLECTION
Data from Configuration Repository
Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.
Detect it with
Identify network traffic sent or received by untrusted hosts or networks that solicits and obtains the configuration information of the queried device.
Why it matters on shift
Data from Configuration Repository is one of the concrete ways adversaries achieve collection. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After collection, the next tactic is usually Command and Control. Search your telemetry for the transition before closing the ticket.
2 sub-techniques
How it shows up in practice
- T1602.001
SNMP (MIB Dump)
Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).
- T1602.002
Network Device Configuration Dump
Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device.
Kill-chain context