AN0246: Analytic 0246
Keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.
Analyst context for executives and security teams
This analytic describes a high-risk scenario for network devices: keystrokes from administrative sessions may be captured through modified system images, altered firmware, or man-in-the-middle sniffing of console access such as Telnet or SSH. For leaders, the significance is that credentials and operational commands for routers, switches, or other network devices can become exposed at the management layer, potentially undermining network control and incident recovery.
Executive priority
Prioritize this as a network infrastructure assurance issue, not only a SOC alerting issue. Executives should ask whether legacy network devices are still in use, whether device images and firmware integrity are verified, whether administrative access paths are encrypted and tightly controlled, and whether evidence exists to support audit and incident-response decisions. Because ATT&CK provides no detection text for this analytic, coverage should be treated as something to validate locally rather than assumed.
Technical view
SOC, detection engineering, and IR teams should validate visibility around network device management sessions, firmware or system image integrity, and signs of unauthorized modification. The supplied platform is Network Devices, and the behavior centers on keylogging through unauthorized image/firmware changes or remote capture of Telnet/SSH console keystrokes. With no ATT&CK detection guidance and no relationship context supplied, teams should build validation around available device logs, configuration change records, image verification processes, management-plane network telemetry, and privileged access activity.
Likely telemetry
- Network device system, authentication, and administrative command logs
- Configuration change and image/firmware update records
- Firmware or system image integrity verification results
- Management-plane traffic involving console access protocols such as Telnet or SSH
- Network path telemetry that could show unexpected interception points or management traffic routing changes
Detection direction
- Confirm whether network devices generate and forward logs for administrative login, command execution, configuration changes, and image or firmware updates.
- Validate that firmware and system image baselines can be compared against trusted versions; gaps here are a major blind spot for altered-image scenarios.
- Review management-plane traffic patterns for unexpected Telnet/SSH paths, unusual intermediaries, or changes in where administrative sessions originate and terminate.
- Tune carefully: legitimate maintenance, upgrades, break-glass access, and network troubleshooting can resemble suspicious administrative activity unless change-management context is available.
- Because ATT&CK provides no official detection text for this analytic, treat detections as environment-specific hypotheses requiring lab validation and incident-response playbooks.
Mitigation priorities
- Inventory legacy network devices and identify where Telnet, weak management paths, or unmanaged firmware processes remain in use.
- Restrict management-plane access to approved administrative networks and accounts, with strong authentication and change control.
- Establish trusted firmware/system image baselines and routine integrity verification for network devices.
- Centralize network device logs and retain configuration and image-change evidence for investigation and compliance support.
- Retire or isolate devices that cannot support adequate logging, secure administration, or image integrity validation.
Analyst notes and limits
The object is a detection analytic, AN0246, for Network Devices. It describes keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes through altered firmware or man-in-the-middle key sniffing. No tactics, labels, aliases, official detection content, or relationships were supplied, so the take focuses on defensive validation and evidence requirements rather than mapped technique-specific behavior.
This assessment is limited to the supplied ATT&CK STIX fields, external reference, and lack of relationship context. It does not establish active exploitation, adversary attribution, prevalence, customer exposure, or guaranteed detection coverage. Local device models, firmware capabilities, management architecture, logging configuration, and change-control evidence are required to determine real risk and coverage.
Analytic 0246
Keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 917c7734fcb5… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0246Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.