T1602: Data from Configuration Repository
Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.
Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.[1][2]
Analyst context for executives and security teams
This technique matters because configuration repositories for network devices can contain concentrated administrative knowledge: device settings, management data, and information useful for understanding the network. If an adversary collects this data, it can improve their ability to map the environment, identify weak points, and support follow-on activity against network infrastructure. For leaders, the key issue is whether network device management data is treated as sensitive business-critical information, not just operational plumbing.
Executive priority
Prioritize this where network devices are critical to business continuity, remote administration, segmentation, or regulated evidence of secure infrastructure management. Executives should ask whether configuration repositories and management protocols are segmented, encrypted where appropriate, patched, securely configured, and monitored. Because ATT&CK provides no official detection text for T1602, assurance should come from validating actual telemetry and control evidence rather than assuming SOC visibility exists.
Technical view
T1602 is an enterprise collection technique for Network Devices. The relationship context highlights two concrete sub-technique areas: SNMP/MIB collection and network device configuration dumps. SOC and IR teams should validate whether they can observe access to device management repositories, SNMP-related activity, configuration file access or transfer, and unusual management-plane traffic. Detection engineering should align with DET0592 where available internally, but ATT&CK does not include detection details in the supplied object, so local data sources, baselines, and device logging capabilities are decisive.
Likely telemetry
- Network device management-plane logs and administrative access records
- SNMP activity records, including queries to MIB/OID data where logged
- Network traffic metadata for management protocols and repository access
- Configuration repository access, export, backup, or transfer logs
- Firewall, segmentation, and network intrusion prevention events involving network device management interfaces
Detection direction
- Confirm which network devices expose configuration repositories or SNMP-accessible management data and whether access is logged centrally.
- Baseline legitimate administrative collection, backup, monitoring, and configuration-management activity to reduce false positives.
- Look for access from unauthorized segments, unexpected sources, unusual volumes, or activity outside normal administration windows.
- Correlate management-plane traffic with identity, change-management, and device logs where available.
- Treat missing device logs, unauthenticated/poorly scoped management access, and unmonitored network segments as material blind spots.
Mitigation priorities
- Segment network device management interfaces and configuration repositories from general user and server networks.
- Filter ingress, egress, and lateral traffic so only authorized systems can reach management services.
- Use network intrusion prevention or detection signatures at relevant boundaries where applicable.
- Encrypt sensitive configuration data and management communications where supported.
- Keep network device software and firmware updated to reduce exposure to known weaknesses.
Analyst notes and limits
The supplied relationships make this most actionable through its sub-techniques: SNMP MIB dumping and network device configuration dumping. Glexia would use this object to drive validation of network infrastructure management security, SOC visibility, and incident response readiness for configuration exposure scenarios.
The official ATT&CK object does not provide detection guidance, procedures, or specific data sources. External references point to SNMP abuse and network infrastructure targeting guidance, but this summary does not infer active exploitation or attribution. Local architecture, device logging, management tooling, and segmentation design are required to determine real exposure and coverage.
Data from Configuration Repository
Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.
Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.[1][2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1602.002 | Network Device Configuration Dump Sub-technique | Network Device Configuration Dump subtechnique of this object. |
| Enterprise | T1602.001 | SNMP (MIB Dump) Sub-technique | SNMP (MIB Dump) subtechnique of this object. |
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | dbb0755a0c55… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
US-CERT-TA18-106A
US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL -
[2]
US-CERT TA17-156A SNMP Abuse 2017
US-CERT. (2017, June 5). Reducing the Risk of SNMP Abuse. Retrieved October 19, 2020.
Open source URL -
[3]
Cisco Advisory SNMP v3 Authentication Vulnerabilities
Cisco. (2008, June 10). Identifying and Mitigating Exploitation of the SNMP Version 3 Authentication Vulnerabilities. Retrieved October 19, 2020.
Open source URL -
[4]
mitre-attack T1602Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.