AN1293 Analytic 1293

Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Defenders may observe adversary attempts to patch system images by monitoring for anomalous file transfers (TFTP, SCP, FTP) of image files, unauthorized CLI commands altering boot system variables, integrity check mismatches between running and baseline OS images, and runtime memory manipulation attempts. Suspicious sequences include uploading a new image, modifying boot parameters, and subsequent reload/reboot of the device. In-memory patching attempts may manifest as debug commands or boot loader manipulation inconsistent with normal administrative activity.</p>

Detects: T1601.001 Patch System Image
Part of: DET0469 Detection Strategy for Patch System Image on Network Devices

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
networkdevice:cli	`Execution of privileged commands such as 'copy tftp flash', 'boot system', or 'debug memory'`	DC0064 Command Execution
networkdevice:config	`Configuration changes to startup image paths, boot loader parameters, or debug flags`	DC0061 File Modification
firmware:runtime	`Debug or memory access commands indicating attempts to alter OS instructions in memory`	DC0004 Firmware Modification

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`ApprovedFirmwareVersions`	Whitelist of validated vendor OS versions; deviations may indicate tampering.
`AuthorizedAdminAccounts`	Trusted admin accounts permitted to update images; anomalies suggest compromise.
`ChecksumBaseline`	Baseline hash of approved images; used for detecting file tampering.
`TimeWindow`	Correlation period for detecting chained behaviors (file upload → boot config change → reboot).