MITRE ATT&CKsub-technique

T1556.004 Network Device Authentication

Published 2020-10-19 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment, Persistence, Credential Access
Platforms
Network Devices
Version
3.0
Created
2020-10-19

Description

Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. Modify System Image may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1556 Modify Authentication Process technique

Tactic · MITRE ATT&CK (3)

  • TA0112 Defense Impairment tactic
  • TA0003 Persistence tactic
  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1032 Multi-factor Authentication mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (3)

  • S9013 DRYHOOK software (malware)
  • S1104 SLOWPULSE software (malware)
  • S0519 SYNful Knock software (malware)

Referenced by Compliance · mitigates (16)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AC-7 Unsuccessful Logon Attempts NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References