Techniques › T1600 › AN0961
AN0961 Analytic 0961
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders may observe unauthorized modifications to encryption-related configuration files, firmware, or crypto modules on network devices. Suspicious patterns include changes to cipher suite configurations, unexpected firmware updates affecting crypto libraries, disabling of hardware cryptographic accelerators, or reductions in key length policies. Correlating configuration changes with anomalies in encrypted traffic characteristics (e.g., weaker ciphers or sudden plaintext transmission) strengthens detection.</p>
- Detects
- T1600 Weaken Encryption
- Part of
- DET0339 Detection Strategy for Weaken Encryption on Network Devices
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:config | Configuration change events referencing encryption, TLS/SSL, or IPSec settings | DC0061 File Modification |
| NSM:Flow | Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols | DC0085 Network Traffic Content |
| snmp:status | Status change in cryptographic hardware modules (enabled -> disabled) | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CipherSuiteWhitelist | List of approved encryption algorithms and key lengths; customizable to organizational policy. |
TimeWindow | Correlation period between configuration changes and abnormal traffic; adjustable to reduce false positives. |
AuthorizedFirmwareSources | Known trusted sources of firmware updates; deviations indicate possible compromise. |
TrafficEntropyThreshold | Baseline entropy measurements of encrypted traffic; deviations may reveal weakening of encryption. |