MITRE ATT&CKsub-technique

T1601.002 Downgrade System Image

Published 2020-10-19 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
Network Devices
Version
2.0
Created
2020-10-19

Description

Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts. Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as Weaken Encryption. Downgrading of a system image can be done on its own, or it can be used in conjunction with Patch System Image.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1601 Modify System Image technique

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (6)

  • M1043 Credential Access Protection mitigation
  • M1045 Code Signing mitigation
  • M1046 Boot Integrity mitigation
  • M1032 Multi-factor Authentication mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by Compliance · mitigates (27)

  • CIS-12.1 Ensure Network Infrastructure is Up-to-Date CIS Safeguard v8.1
  • CIS-12.5 Centralize Network Authentication, Authorization, and Auditing network AAA CIS Safeguard v8.1
  • CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SC-34 Non-modifiable Executable Programs NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-11 Component Authenticity NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control

References