Network Device Configuration Dump
Subtechnique · ATTACK:enterprise:T1602.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1602.002",
"title": "Network Device Configuration Dump",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1602/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--52759bf1-fe12-4052-ace6-c5b0cf7dd7fd",
"external_id": "T1602.002",
"domain": "enterprise",
"created": "2020-10-20T00:08:21.745Z",
"modified": "2026-05-12T15:12:00.633Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Cisco Blog Legacy Device Attacks",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
},
{
"source_name": "US-CERT TA18-106A Network Infrastructure Devices 2018",
"url": "https://us-cert.cisa.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "US-CERT TA18-068A 2018",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-086A"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:T1602.002 → subtechnique-of → ATTACK:enterprise:T1602
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f262330-4075-4fce-91b7-c3f0fd7a0739
ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34a3a837-87e0-4ee7-a268-354a79f69927
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38762462-11f6-4f44-bda3-4da3c2c8d70d
US-CERT TA17-156A SNMP Abuse 2017ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dbcc83a-1e60-4ae4-a1f9-b37e1aa7d7b0
US-CERT TA17-156A SNMP Abuse 2017ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4927fe17-942f-4424-aebb-b403126f4828
CERT PolskaATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80da7758-2be4-4f34-bfa2-621120eb8a3f
CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9160a38d-799b-431d-a5d1-a9b4099ab8b1
US-CERT TA18-106A Network Infrastructure Devices 2018ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91baa343-383f-4010-b799-67e42bd8a016
Cisco Securing SNMP · US-CERT TA18-106A Network Infrastructure Devices 2018ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--940764df-0039-40fa-a3c7-ce064ceed4ea
US-CERT TA17-156A SNMP Abuse 2017ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae8a7787-7915-4dfa-bf79-73fd76dc6473
Cisco Blog Legacy Device Attacks