MITRE ATT&CKsub-technique

T1059.008 Network Device CLI

Published 2020-10-20 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Network Devices
Version
1.2
Created
2020-10-20

Description

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or SSH. Adversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1038 Execution Prevention mitigation
  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (6)

  • C0063 2025 Poland Wiper Attacks campaign
  • S9014 PHASEJAM software (malware)
  • S9013 DRYHOOK software (malware)
  • C0056 RedPenguin campaign
  • G1045 Salt Typhoon group
  • S1186 Line Dancer software (malware)

Referenced by Compliance · mitigates (21)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-12.3 Securely Manage Network Infrastructure CIS Safeguard v8.1
  • CIS-12.5 Centralize Network Authentication, Authorization, and Auditing network AAA CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References