Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1602.002_network-device-configuration-dump
Adversaries may access network configuration files to collect sensitive data about the device and the network.
Passed 16 of 22 test cases with the skill, and 16 of 22 without it.
1 fixed15 passed either way5 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Where does network device configuration dumping fit within the MITRE ATT&CK framework tactical taxonomy?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies the sub-technique ID as T1602.002. | Missed | Passed |
| Identifies the tactical phase as Collection (TA0009). | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1602
Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.
Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files. These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Platforms: Network Devices
Identify Attack Surface: Determine if the target environment is susceptible to Network Device Configuration Dump by examining the target platforms (Network Devices).
Assess Existing Defenses: Review whether mitigations for T1602.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Configure SNMPv3 to use the highest level of security (authPriv) available.
test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.