Techniques › T1601 › T1601.002
T1601.002 Downgrade System Image
defense impairment — Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1601.002
0
KEV CVEs mapped here
<p>Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features.</p><p>On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts.</p><p>Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as Weaken Encryption. Downgrading of a system image can be done on its own, or it can be used in conjunction with Patch System Image.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0569 Detection Strategy for Downgrade System Image on Network Devices v1.0
AN1570 Network DevicesDefenders may observe adversary attempts to downgrade system images by monitoring for anomalous file transfers of OS image files (via TFTP, FTP, SCP), configuration changes pointing boot system variables to older image files, unexpected OS version strings after reboot, and checksum mismatches against approved baseline images. Suspicious chains include transfer of an older image, alteration of boot configuration, and reboot/reload of the device. Adversaries may also tamper with CLI output to disguise downgrade attempts, requiring independent validation of OS version and integrity.networkdevice:cli
Execution of commands such as 'copy tftp flash', 'boot system <image>', 'reload'→ DC0064 Command Executionnetworkdevice:configConfiguration changes referencing older image versions or unexpected boot parameters→ DC0061 File Modificationnetworkdevice:syslogOS version query results inconsistent with expected or approved version list→ DC0059 File MetadataTunable:ApprovedFirmwareVersionsChecksumBaselineTimeWindowAuthorizedAdminAccounts
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1601.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.