AN0482 Analytic 0482

Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Defenders may observe adversary attempts to alter or replace a network device’s operating system image through anomalous CLI commands, unexpected firmware updates, integrity check failures, or mismatches in version and checksum validation. Suspicious behavior includes modification of image files on storage, OS version output inconsistent with baselines, unexpected reloads or reboots after image replacement, and changes to boot configuration that load non-standard system images.</p>

Detects: T1601 Modify System Image
Part of: DET0170 Detection Strategy for Modify System Image on Network Devices

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
networkdevice:cli	`Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system')`	DC0064 Command Execution
networkdevice:config	`Configuration changes to boot variables, startup image paths, or checksum verification failures`	DC0061 File Modification

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`AuthorizedAdminAccounts`	Defines trusted administrator accounts allowed to modify system images; deviations indicate possible malicious modification.
`ApprovedFirmwareVersions`	Whitelist of validated vendor OS images; unexpected versions may suggest adversarial tampering.
`TimeWindow`	Correlation window for detecting config changes followed by firmware updates or reboots.
`ChecksumBaseline`	Baseline cryptographic hashes of approved system images; deviations may indicate compromise.

KEV CVEs whose mapped technique this analytic detects

CVE	Vendor / product	State
CVE-2021-44168	Fortinet FortiOS	Mapped