AN1249 Analytic 1249

Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Defenders may observe suspicious SNMP MIB enumeration through abnormal queries for large sets of OIDs, repeated SNMP GETBULK/GETNEXT requests, or queries originating from non-administrative IP addresses. Anomalous use of community strings, authentication failures, or enumeration activity outside maintenance windows may also indicate attempts to dump MIB contents. Correlation across syslog, NetFlow, and SNMP audit data can reveal chains of behavior such as repeated authentication failures followed by successful large-scale OID retrieval.</p>

Detects: T1602.001 SNMP (MIB Dump)
Part of: DET0453 Detection Strategy for SNMP (MIB Dump) on Network Devices

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
networkdevice:syslog	`Authentication failures, unexpected community string usage, or unauthorized SNMPv1/v2 requests`	DC0085 Network Traffic Content
NSM:Flow	`High-volume or repeated SNMP GETBULK/GETNEXT queries from untrusted or external IPs`	DC0082 Network Connection Creation
networkdevice:audit	`SNMP configuration changes, such as enabling read/write access or modifying community strings`	DC0061 File Modification

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`AuthorizedAdminIPs`	Expected IP ranges allowed to query SNMP. Deviation indicates possible misuse.
`NormalSNMPQueryRate`	Baseline frequency and volume of SNMP queries; anomalies above threshold may indicate dumping.
`CommunityStringPatterns`	Expected community strings (e.g., hashed or custom values). Unrecognized strings may signal abuse.
`TimeWindow`	Time periods during which SNMP queries are authorized. Queries outside these hours may be malicious.