T1602.002 Network Device Configuration Dump Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

// Detect network device configuration dump via SNMP, Smart Install (SMI), and TFTP
// PREREQUISITES: Network devices must forward syslog to a Sentinel-connected syslog collector;
// perimeter firewall logs must be ingested via CommonSecurityLog (CEF format)
//
// Branch 1: Cisco/network device syslog indicating config copy, archive, or SMI events
let ConfigDumpSyslog = Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any (
    "copy running-config", "copy startup-config", "copy nvram:",
    "ARCHIVE-5-CONFIG_LOG_CNFG_CMD", "SYS-5-CONFIG_I", "CONFIG_LOG_CNFG_CMD",
    "Smart Install", "vstack", "SMI_CLIENT", "SMI-5-",
    "tftp://", "ftp://", "scp://",
    "SNMP-3-AUTHFAIL"
  )
| extend ConfigCopyDetected = SyslogMessage has_any ("copy running-config", "copy startup-config", "copy nvram:")
| extend SMIDetected = SyslogMessage has_any ("Smart Install", "vstack", "SMI_CLIENT", "SMI-5-")
| extend RemoteTransferDetected = SyslogMessage has_any ("tftp://", "ftp://", "scp://")
| extend ArchiveDetected = SyslogMessage has_any ("ARCHIVE-5-CONFIG", "CONFIG_LOG_CNFG_CMD", "SYS-5-CONFIG_I")
| extend SNMPAuthFailure = SyslogMessage has "SNMP-3-AUTHFAIL"
| project TimeGenerated, HostName, HostIP, Facility, SeverityLevel, SyslogMessage,
          ConfigCopyDetected, SMIDetected, RemoteTransferDetected, ArchiveDetected, SNMPAuthFailure;
// Branch 2: Smart Install (SMI) connections on TCP/4786 — no authentication, direct exploitation vector
let SMIConnections = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 4786
| where Protocol has_any ("TCP", "6")
| extend ConfigCopyDetected = false
| extend SMIDetected = true
| extend RemoteTransferDetected = false
| extend ArchiveDetected = false
| extend SNMPAuthFailure = false
| project TimeGenerated,
          HostName = DeviceName,
          HostIP = DestinationIP,
          Facility = "",
          SeverityLevel = "",
          SyslogMessage = strcat("Smart Install TCP/4786 connection: ", SourceIP, " -> ", DestinationIP),
          ConfigCopyDetected, SMIDetected, RemoteTransferDetected, ArchiveDetected, SNMPAuthFailure;
// Branch 3: TFTP transfers involving configuration file keywords (device-initiated config exfil)
let TFTPConfigTransfers = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 69 or SourcePort == 69
| where Message has_any ("running-config", "startup-config", "nvram", ".cfg", "config")
| extend ConfigCopyDetected = false
| extend SMIDetected = false
| extend RemoteTransferDetected = true
| extend ArchiveDetected = false
| extend SNMPAuthFailure = false
| project TimeGenerated,
          HostName = DeviceName,
          HostIP = DestinationIP,
          Facility = "",
          SeverityLevel = "",
          SyslogMessage = strcat("TFTP config transfer: ", SourceIP, ":", tostring(SourcePort), " -> ", DestinationIP, ":", tostring(DestinationPort), " | ", Message),
          ConfigCopyDetected, SMIDetected, RemoteTransferDetected, ArchiveDetected, SNMPAuthFailure;
union ConfigDumpSyslog, SMIConnections, TFTPConfigTransfers
| sort by TimeGenerated desc

high severity medium confidence

Data Sources

Network: Network Traffic Network: Network Device Configuration Network Traffic: Network Traffic Flow

Required Tables

Syslog CommonSecurityLog

False Positives

Legitimate network administrators or NOC staff running scheduled configuration backups via TFTP or SNMP using tools such as RANCID, Oxidized, or SolarWinds Network Configuration Manager — these will trigger config copy syslog events and TFTP transfers from authorized NMS hosts
Network management platforms (SolarWinds, PRTG, Cisco Prime Infrastructure, Ansible AWX) performing routine SNMP polls and automated configuration archiving during defined maintenance windows
Cisco Smart Install legitimately configured for Zero-Touch Provisioning (ZTP) in branch office or retail deployments where new switches bootstrap from a director — any SMI traffic from the provisioning server to device subnets is expected
Security scanners and network auditing tools (Nessus, Qualys, Rapid7 InsightVM) performing scheduled SNMP enumeration as part of vulnerability assessments, generating SNMP-3-AUTHFAIL events if community strings have been rotated
Disaster recovery drills or network operations testing where engineers explicitly copy running configurations to test TFTP servers as part of backup validation procedures

Splunk

spl

(index=network OR index=syslog OR index=main)
(
  sourcetype="cisco:ios"
  OR sourcetype="cisco:ios:syslog"
  OR sourcetype="cisco:asa"
  OR sourcetype="cisco:nexus"
  OR sourcetype="juniper"
  OR sourcetype="juniper:junos:syslog"
  OR sourcetype="fortigate_event"
  OR sourcetype=syslog
)
(
  "copy running-config" OR "copy startup-config" OR "copy nvram:"
  OR "ARCHIVE-5-CONFIG" OR "SYS-5-CONFIG_I" OR "CONFIG_LOG_CNFG_CMD"
  OR "Smart Install" OR "SMI_CLIENT" OR "vstack"
  OR "tftp://" OR "ftp://" OR "scp://"
  OR "SNMP-3-AUTHFAIL"
)
| eval ConfigCopy=if(match(_raw, "copy (running|startup)-config|copy nvram:"), 1, 0)
| eval SMIActivity=if(match(_raw, "Smart Install|SMI_CLIENT|SMI-5|vstack"), 1, 0)
| eval RemoteTransfer=if(match(_raw, "tftp://|ftp://|scp://"), 1, 0)
| eval ArchiveOperation=if(match(_raw, "ARCHIVE-5-CONFIG|CONFIG_LOG_CNFG_CMD|SYS-5-CONFIG_I"), 1, 0)
| eval SNMPAuthFail=if(match(_raw, "SNMP-3-AUTHFAIL"), 1, 0)
| eval SuspicionScore=ConfigCopy + SMIActivity + RemoteTransfer + ArchiveOperation + SNMPAuthFail
| where SuspicionScore > 0
| table _time, host, src_ip, dest_ip, sourcetype, ConfigCopy, SMIActivity, RemoteTransfer, ArchiveOperation, SNMPAuthFail, SuspicionScore, _raw
| sort -SuspicionScore, -_time

high severity medium confidence

Data Sources

Network: Network Traffic Network: Network Device Configuration Syslog: Cisco IOS Syslog: Juniper JunOS

Required Sourcetypes

cisco:ios cisco:ios:syslog syslog

False Positives

Legitimate network administrators or NOC staff running scheduled configuration backups via TFTP or SNMP using tools such as RANCID, Oxidized, or SolarWinds Network Configuration Manager — these will trigger config copy syslog events and TFTP transfers from authorized NMS hosts
Network management platforms (SolarWinds, PRTG, Cisco Prime Infrastructure, Ansible AWX) performing routine SNMP polls and automated configuration archiving during defined maintenance windows
Cisco Smart Install legitimately configured for Zero-Touch Provisioning (ZTP) in branch office or retail deployments where new switches bootstrap from a director — any SMI traffic from the provisioning server to device subnets is expected
Security scanners and network auditing tools (Nessus, Qualys, Rapid7 InsightVM) performing scheduled SNMP enumeration as part of vulnerability assessments, generating SNMP-3-AUTHFAIL events if community strings have been rotated
Disaster recovery drills or network operations testing where engineers explicitly copy running configurations to test TFTP servers as part of backup validation procedures

Elastic Security (EQL)

eql

any where process.name : ("snmpwalk", "snmpbulkwalk", "braa", "onesixtyone", "snmpenum", "snmpcheck") or (network.transport : "udp" and destination.port == 161 and network.bytes > 5000)

high severity medium confidence

Data Sources

Elastic Endpoint Security Network Traffic

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.network-*

False Positives

Legitimate network administrators or NOC staff running scheduled configuration backups via TFTP or SNMP using tools such as RANCID, Oxidized, or SolarWinds Network Configuration Manager — these will trigger config copy syslog events and TFTP transfers from authorized NMS hosts
Network management platforms (SolarWinds, PRTG, Cisco Prime Infrastructure, Ansible AWX) performing routine SNMP polls and automated configuration archiving during defined maintenance windows
Cisco Smart Install legitimately configured for Zero-Touch Provisioning (ZTP) in branch office or retail deployments where new switches bootstrap from a director — any SMI traffic from the provisioning server to device subnets is expected
Security scanners and network auditing tools (Nessus, Qualys, Rapid7 InsightVM) performing scheduled SNMP enumeration as part of vulnerability assessments, generating SNMP-3-AUTHFAIL events if community strings have been rotated
Disaster recovery drills or network operations testing where engineers explicitly copy running configurations to test TFTP servers as part of backup validation procedures

IBM QRadar (AQL)

sql

SELECT sourceip as "SourceIP", destinationip as "DestinationIP", destinationport as "DestPort", UTF8(payload) as "Payload", devicetime as "EventTime", CASE WHEN "DestPort" = 161 AND eventcount > 50 THEN 80 WHEN UTF8(payload) ILIKE '%community%' AND UTF8(payload) ILIKE '%OID%' THEN 70 ELSE 50 END as "RiskScore" FROM events WHERE destinationport = 161 AND LOGSOURCETYPENAME(devicetype) IN ('Cisco IOS', 'Cisco IOS XE', 'Linux OS', 'Juniper Networks Junos') ORDER BY eventcount DESC LAST 24 HOURS

high severity medium confidence

Data Sources

Network Traffic Linux OS Windows OS

Required Tables

events

False Positives

Legitimate network administrators or NOC staff running scheduled configuration backups via TFTP or SNMP using tools such as RANCID, Oxidized, or SolarWinds Network Configuration Manager — these will trigger config copy syslog events and TFTP transfers from authorized NMS hosts
Network management platforms (SolarWinds, PRTG, Cisco Prime Infrastructure, Ansible AWX) performing routine SNMP polls and automated configuration archiving during defined maintenance windows
Cisco Smart Install legitimately configured for Zero-Touch Provisioning (ZTP) in branch office or retail deployments where new switches bootstrap from a director — any SMI traffic from the provisioning server to device subnets is expected
Security scanners and network auditing tools (Nessus, Qualys, Rapid7 InsightVM) performing scheduled SNMP enumeration as part of vulnerability assessments, generating SNMP-3-AUTHFAIL events if community strings have been rotated
Disaster recovery drills or network operations testing where engineers explicitly copy running configurations to test TFTP servers as part of backup validation procedures

Sumo Logic CSE

sql

_sourceCategory=network/snmp OR _sourceCategory=endpoint/process | json auto | where dest_port = 161 or process_name in ("snmpwalk", "snmpbulkwalk", "braa", "onesixtyone") | if(matches(process_name, "*braa*") or matches(process_name, "*onesixtyone*"), "High", if(matches(process_name, "*snmpwalk*") or matches(process_name, "*snmpbulkwalk*"), "Medium", "Low")) as RiskLevel | stats count by src_ip, dest_ip, process_name, RiskLevel | sort by count desc

high severity medium confidence

Data Sources

Network Traffic Endpoint Process Events

Required Tables

network/snmp endpoint/process

False Positives

Legitimate network administrators or NOC staff running scheduled configuration backups via TFTP or SNMP using tools such as RANCID, Oxidized, or SolarWinds Network Configuration Manager — these will trigger config copy syslog events and TFTP transfers from authorized NMS hosts
Network management platforms (SolarWinds, PRTG, Cisco Prime Infrastructure, Ansible AWX) performing routine SNMP polls and automated configuration archiving during defined maintenance windows
Cisco Smart Install legitimately configured for Zero-Touch Provisioning (ZTP) in branch office or retail deployments where new switches bootstrap from a director — any SMI traffic from the provisioning server to device subnets is expected
Security scanners and network auditing tools (Nessus, Qualys, Rapid7 InsightVM) performing scheduled SNMP enumeration as part of vulnerability assessments, generating SNMP-3-AUTHFAIL events if community strings have been rotated
Disaster recovery drills or network operations testing where engineers explicitly copy running configurations to test TFTP servers as part of backup validation procedures

Google Chronicle / SecOps

yaral

rule detect_snmp_enumeration {
  meta:
    author = "Argus"
    description = "Detects SNMP-based network device enumeration"
    severity = "HIGH"
    technique = "T1602"
  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.target.port = 161
    $e.network.ip_protocol = "UDP"
    $e.network.sent_bytes > 1000
  condition:
    $e
}

high severity medium confidence

Data Sources

Endpoint Telemetry Network Traffic

Required Tables

NETWORK_CONNECTION PROCESS_LAUNCH

False Positives

Legitimate network administrators or NOC staff running scheduled configuration backups via TFTP or SNMP using tools such as RANCID, Oxidized, or SolarWinds Network Configuration Manager — these will trigger config copy syslog events and TFTP transfers from authorized NMS hosts
Network management platforms (SolarWinds, PRTG, Cisco Prime Infrastructure, Ansible AWX) performing routine SNMP polls and automated configuration archiving during defined maintenance windows
Cisco Smart Install legitimately configured for Zero-Touch Provisioning (ZTP) in branch office or retail deployments where new switches bootstrap from a director — any SMI traffic from the provisioning server to device subnets is expected
Security scanners and network auditing tools (Nessus, Qualys, Rapid7 InsightVM) performing scheduled SNMP enumeration as part of vulnerability assessments, generating SNMP-3-AUTHFAIL events if community strings have been rotated
Disaster recovery drills or network operations testing where engineers explicitly copy running configurations to test TFTP servers as part of backup validation procedures

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| ImageFileName = /snmpwalk|snmpbulkwalk|braa|onesixtyone|snmpenum|snmpcheck/i
| case {
    ImageFileName = /braa|onesixtyone/i | ToolType := "Mass SNMP Scanner";
    ImageFileName = /snmpwalk|snmpbulkwalk/i | ToolType := "SNMP Walker";
    * | ToolType := "SNMP Tool"
  }
| table([@timestamp, UserName, ComputerName, ImageFileName, CommandHistory, ToolType])

high severity medium confidence

Data Sources

ProcessRollup2 (Falcon sensor) NetworkConnectIP4

Required Tables

ProcessRollup2 NetworkConnectIP4

False Positives

Legitimate network administrators or NOC staff running scheduled configuration backups via TFTP or SNMP using tools such as RANCID, Oxidized, or SolarWinds Network Configuration Manager — these will trigger config copy syslog events and TFTP transfers from authorized NMS hosts
Network management platforms (SolarWinds, PRTG, Cisco Prime Infrastructure, Ansible AWX) performing routine SNMP polls and automated configuration archiving during defined maintenance windows
Cisco Smart Install legitimately configured for Zero-Touch Provisioning (ZTP) in branch office or retail deployments where new switches bootstrap from a director — any SMI traffic from the provisioning server to device subnets is expected
Security scanners and network auditing tools (Nessus, Qualys, Rapid7 InsightVM) performing scheduled SNMP enumeration as part of vulnerability assessments, generating SNMP-3-AUTHFAIL events if community strings have been rotated
Disaster recovery drills or network operations testing where engineers explicitly copy running configurations to test TFTP servers as part of backup validation procedures

Network Device Configuration Dump

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Collection

Popular Detections