Detect Data from Configuration Repository in Elastic Security
This detection identifies adversaries targeting network device configuration repositories to collect sensitive system administration data. Attackers exploit SNMP (Simple Network Management Protocol) community strings to perform MIB (Management Information Base) dumps, use TFTP/SCP/FTP to retrieve running or startup configurations from routers, switches, and firewalls, or abuse network management platforms (NMS) such as SolarWinds, PRTG, or Cisco DNA Center. Detection focuses on anomalous SNMP bulk-walk queries originating from non-management hosts, unexpected TFTP transfers from network infrastructure devices, unusual authentication events against network management systems, and high-volume SNMP OID enumeration patterns indicative of automated reconnaissance tools.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1602 Data from Configuration Repository
- Canonical reference
- https://attack.mitre.org/techniques/T1602/
Elastic Detection Query
any where process.name : ("snmpwalk", "snmpbulkwalk", "braa", "onesixtyone", "snmpenum", "snmpcheck") or (network.transport : "udp" and destination.port == 161 and network.bytes > 5000)Elastic EQL translation of the T1602 detection logic. Detects SNMP enumeration tools (snmpwalk, snmpbulkwalk, braa, onesixtyone), SNMP traffic originating from non-management hosts, TFTP-based configurati
Data Sources
Required Tables
False Positives & Tuning
- Legitimate network management systems (SolarWinds, PRTG, Nagios, Zabbix) performing scheduled SNMP polling of network infrastructure
- IT operations teams running snmpwalk/snmpget during troubleshooting or capacity planning activities
- Authorized TFTP-based network device backup jobs executed by configuration management tools like Oxidized, RANCID, or BackupNinja
- Network monitoring agents and vulnerability scanners (Nessus, Qualys) querying SNMP-enabled devices during credentialed scans
Other platforms for T1602
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SNMP MIB Bulk Walk Using snmpwalk
Expected signal: Linux process exec events showing snmpwalk/snmptable with -v2c flag and community string argument. DeviceProcessEvents (if MDE Linux agent deployed) or auditd exec logs. Network flow telemetry showing UDP/161 traffic to target IP.
- Test 2Network Device Configuration Dump via TFTP
Expected signal: DeviceNetworkEvents showing UDP/69 connection. DeviceProcessEvents showing tftp.exe execution with remote host IP argument. Windows Security Event 5156 (Windows Filtering Platform permitted connection) for TFTP traffic. TFTP server access logs showing GET request for config file.
- Test 3SNMP Community String Brute Force with onesixtyone
Expected signal: High-volume UDP/161 packets from single source IP visible in NetFlow/IPFIX or network TAP data. Network device syslog SNMP-3-AUTHFAIL entries for failed community strings. DeviceNetworkEvents if source host has MDE agent showing rapid UDP connections to port 161 across multiple destinations.
References (8)
- https://attack.mitre.org/techniques/T1602/
- https://attack.mitre.org/techniques/T1602/001/
- https://attack.mitre.org/techniques/T1602/002/
- https://us-cert.cisa.gov/ncas/alerts/TA18-106A
- https://us-cert.cisa.gov/ncas/alerts/TA17-156A
- https://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/command/reference/ffun_r/frf003.html
- https://www.rfc-editor.org/rfc/rfc3411
- https://www.ncsc.gov.uk/guidance/network-device-hardening
Unlock Pro Content
Get the full detection package for T1602 including response playbook, investigation guide, and atomic red team tests.