Techniques › T1601
T1601 Modify System Image
defense impairment — Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1601
1
KEV CVEs mapped here
<p>Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.</p><p>To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2021-44168 | Fortinet FortiOS | primary impact | Mapped | 2021-12-10 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0170 Detection Strategy for Modify System Image on Network Devices v1.0
AN0482 Network DevicesDefenders may observe adversary attempts to alter or replace a network device’s operating system image through anomalous CLI commands, unexpected firmware updates, integrity check failures, or mismatches in version and checksum validation. Suspicious behavior includes modification of image files on storage, OS version output inconsistent with baselines, unexpected reloads or reboots after image replacement, and changes to boot configuration that load non-standard system images.networkdevice:cli
Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system')→ DC0064 Command Executionnetworkdevice:configConfiguration changes to boot variables, startup image paths, or checksum verification failures→ DC0061 File ModificationTunable:AuthorizedAdminAccountsApprovedFirmwareVersionsTimeWindowChecksumBaseline
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1601
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content. 1 actively exploited CVE maps here.