{
  "node_id": "mitre-attack-t1602-data-from-configuration-repository",
  "title": "MITRE ATT&CK T1602: Data from Configuration Repository (Enterprise Tactic TA0009 - Collection)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-05-25",
  "bluf": "MITRE ATT&CK T1602 (Data from Configuration Repository) is an Enterprise Collection technique. Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. ATT&CK documents 2 sub-techniques: T1602.001 SNMP (MIB Dump); T1602.002 Network Device Configuration Dump. Affected platforms: Network. MITRE-documented mitigations include M1051 Update Software, M1054 Software Configuration, M1030 Network Segmentation, M1037 Filter Network Traffic, M1031 Network Intrusion Prevention, M1041 Encrypt Sensitive Information. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-03, AC-04, AC-16, AC-17, AC-18, AC-19, AC-20, CA-07.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-cybersecurity-framework-2-0",
    "iso-27001-2022",
    "nist-sp-800-53-r5",
    "cis-controls-v8",
    "mitre-attack-framework-v14"
  ],
  "primary_citations_count": 7
}