Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.
Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1602 | Data from Configuration Repository |
Comments
When known vulnerabilities affect network-device software, system images, or management components that expose configuration repositories, applying patches or supported software upgrades removes those weaknesses and reduces vulnerability dependent access to configuration data.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1602 | Data from Configuration Repository | |
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1602 | Data from Configuration Repository |
Comments
Configure network intrusion prevention solutions to identify and block unauthorized management queries and commands used to access network-device configuration repositories.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1602 | Data from Configuration Repository |
Comments
Apply network access-control rules between trusted and untrusted segments to block unauthorized management protocols used to reach configuration repositories and managed network devices.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1602 | Data from Configuration Repository |
Comments
Removing unnecessary configuration-management protocols and repositories reduces the systems and services from which adversaries can collect configuration data.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1602 | Data from Configuration Repository |
Comments
Secure management protocols, authenticated access, and controlled configuration repositories directly reduce unauthorized collection of device and infrastructure configuration. Version-controlled Infrastructure-as-Code can also reduce the need to retrieve configurations through insecure management interfaces.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1602 | Data from Configuration Repository |
Comments
Production configuration-management interfaces and repositories can be placed on network or management segments that are not directly reachable from non-production systems, reducing unauthorized collection of production configuration data.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Scan network | Enumerating the state of the network | related-to | T1602 | Data from Configuration Repository | |
| action.malware.variety.Capture stored data | Capture data stored on system disk | related-to | T1602 | Data from Configuration Repository | |
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1602 | Data from Configuration Repository |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| vpc_service_controls | VPC Service Controls | technique_scores | T1602 | Data from Configuration Repository |
Comments
VPC security perimeters can isolate resources and limit the impact from lateral movement techniques used to access sensitive data.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| amazon_virtual_private_cloud | Amazon Virtual Private Cloud | technique_scores | T1602 | Data from Configuration Repository |
Comments
VPC security groups and network access control lists (NACLs) can limit attackers' access to configuration repositories such as SNMP management stations, or to dumps of client configurations from common management ports.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1602.002 | Network Device Configuration Dump | 12 |
| T1602.001 | SNMP (MIB Dump) | 14 |