{"id":"T1602.001","name":"SNMP (MIB Dump)","url":"https://attack.mitre.org/techniques/T1602/001","tactics":["collection"],"platforms":["Network Devices"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0453","stix_id":"x-mitre-detection-strategy--2dc6a789-2dd7-4d64-be82-73db6fc3fb70","name":"Detection Strategy for SNMP (MIB Dump) on Network Devices","url":"https://attack.mitre.org/detectionstrategies/DET0453","analytics":[{"id":"AN1249","stix_id":"x-mitre-analytic--282d9231-942a-4b97-875c-659aa2c41971","name":"Analytic 1249","description":"Defenders may observe suspicious SNMP MIB enumeration through abnormal queries for large sets of OIDs, repeated SNMP GETBULK/GETNEXT requests, or queries originating from non-administrative IP addresses. Anomalous use of community strings, authentication failures, or enumeration activity outside maintenance windows may also indicate attempts to dump MIB contents. Correlation across syslog, NetFlow, and SNMP audit data can reveal chains of behavior such as repeated authentication failures followed by successful large-scale OID retrieval.","url":"https://attack.mitre.org/detectionstrategies/DET0453#AN1249","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"Authentication failures, unexpected community string usage, or unauthorized SNMPv1/v2 requests","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"networkdevice-syslog"},{"name":"NSM:Flow","channel":"High-volume or repeated SNMP GETBULK/GETNEXT queries from untrusted or external IPs","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"},{"name":"networkdevice:audit","channel":"SNMP configuration changes, such as enabling read/write access or modifying community strings","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"networkdevice-audit"}],"mutable_elements":[{"field":"AuthorizedAdminIPs","description":"Expected IP ranges allowed to query SNMP. Deviation indicates possible misuse."},{"field":"NormalSNMPQueryRate","description":"Baseline frequency and volume of SNMP queries; anomalies above threshold may indicate dumping."},{"field":"CommunityStringPatterns","description":"Expected community strings (e.g., hashed or custom values). Unrecognized strings may signal abuse."},{"field":"TimeWindow","description":"Time periods during which SNMP queries are authorized. Queries outside these hours may be malicious."}],"live":true,"detection_strategies":["DET0453"],"techniques":["T1602.001"]}],"live":true,"version":"1.0","techniques":["T1602.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}