Techniques › T1600.002 › AN1360
AN1360 Analytic 1360
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders may observe attempts to disable dedicated crypto hardware on network devices, often visible through anomalous CLI commands, unexpected firmware or configuration updates, and degraded encryption performance. Suspicious indicators include commands that alter hardware acceleration settings (e.g., disabling AES-NI or crypto engines), modification of system image files, or logs showing fallback from hardware to software encryption. Network traffic analysis may also reveal a sudden downgrade in throughput or cipher negotiation behavior consistent with the absence of hardware acceleration.</p>
- Detects
- T1600.002 Disable Crypto Hardware
- Part of
- DET0494 Detection Strategy for Weaken Encryption: Disable Crypto Hardware on Network Devices
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:cli | Execution of commands disabling crypto hardware acceleration (e.g., 'no crypto engine enable') | DC0064 Command Execution |
| networkdevice:config | Configuration changes referencing cryptographic hardware modules or disabling hardware acceleration | DC0061 File Modification |
| NSM:Flow | Degraded encryption throughput or switch to weaker cipher suites compared to historical baselines | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedAdminAccounts | Defines trusted administrator accounts allowed to modify encryption hardware settings; deviations trigger alerts. |
BaselineThroughput | Expected performance metrics with hardware acceleration enabled; drops may indicate tampering. |
ApprovedFirmwareVersions | Whitelist of vendor-signed firmware versions; unexpected updates could signal malicious modification. |
TimeWindow | Period of correlation between configuration change and observed traffic downgrade; tunable to reduce false positives. |