What MITRE ATT&CK T1556.004: Network Device Authentication (Enterprise Tactic TA0006 - Credential Access / TA0005 - Defense Evasion / TA0003 - Persistence) requires
MITRE ATT&CK T1556.004 (Network Device Authentication) is an Enterprise Credential Access and Defense Evasion and Persistence sub-technique of T1556 (Modify Authentication Process). Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. Modify System Image may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Affected platforms: Network. MITRE-documented mitigations include M1026 Privileged Account Management, M1032 Multi-factor Authentication. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, AC-07, AC-20, CA-07, CM-02.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1556/004/
SHA-256 integrity: 5df7fcd7118d6c3c923779aa8349f3594d155ed42c5a3eb95a81360635cd684d
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1556.004: Network Device Authentication (https://attack.mitre.org/techniques/T1556/004/)
- MITRE ATT&CK Tactic TA0006: Credential Access (https://attack.mitre.org/tactics/TA0006/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1556-004-network-device-authentication.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1556-004-network-device-authentication.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1556-004-network-device-authentication
- Back to registry: Browse all 10,085 compliance nodes