What MITRE ATT&CK T1602: Data from Configuration Repository (Enterprise Tactic TA0009 - Collection) requires
MITRE ATT&CK T1602 (Data from Configuration Repository) is an Enterprise Collection technique. Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. ATT&CK documents 2 sub-techniques: T1602.001 SNMP (MIB Dump); T1602.002 Network Device Configuration Dump. Affected platforms: Network. MITRE-documented mitigations include M1051 Update Software, M1054 Software Configuration, M1030 Network Segmentation, M1037 Filter Network Traffic, M1031 Network Intrusion Prevention, M1041 Encrypt Sensitive Information. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-03, AC-04, AC-16, AC-17, AC-18, AC-19, AC-20, CA-07.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1602/
SHA-256 integrity: dfbf6660d04df347bda997a7f1fe9862433671d72ba97fd30e5585511979ef03
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1602: Data from Configuration Repository (https://attack.mitre.org/techniques/T1602/) with 2 sub-techniques
- MITRE ATT&CK Tactic TA0009: Collection (https://attack.mitre.org/tactics/TA0009/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access