1. Home
  2. Matrices
  3. Enterprise
  4. Network Devices

Network Devices Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® Network Devices platform. The techniques below are known to target network devices such as routers, switches, and load balancers. The Matrix contains information for the Network Devices platform.

View on the ATT&CK® Navigator
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
3 techniques 3 techniques 11 techniques 5 techniques 6 techniques 7 techniques 6 techniques 11 techniques 1 techniques 4 techniques 7 techniques 2 techniques 4 techniques
Exploit Public-Facing Application
Valid Accounts (2)
=
Wi-Fi Networks
Command and Scripting Interpreter (3)
=
Scheduled Task/Job
Software Deployment Tools
Account Manipulation (1)
=
Boot or Logon Autostart Execution
Boot or Logon Initialization Scripts (1)
=
Create Account (1)
=
Modify Authentication Process (1)
=
Power Settings
Pre-OS Boot (3)
=
Scheduled Task/Job
Server Software Component (1)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Account Manipulation (1)
=
Boot or Logon Autostart Execution
Boot or Logon Initialization Scripts (1)
=
Scheduled Task/Job
Valid Accounts (2)
=
Direct Volume Access
Indicator Removal (3)
=
Obfuscated Files or Information (1)
=
Pre-OS Boot (3)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Disable or Modify System Firewall (1)
=
Disable or Modify Tools
Modify Authentication Process (1)
=
Modify System Image (2)
=
Network Boundary Bridging (1)
=
Prevent Command History Logging
Weaken Encryption (2)
=
Adversary-in-the-Middle (1)
=
Brute Force (4)
=
Input Capture (1)
=
Modify Authentication Process (1)
=
Network Sniffing
Unsecured Credentials (1)
=
File and Directory Discovery
Network Service Discovery
Network Sniffing
Password Policy Discovery
Process Discovery
Remote System Discovery
System Information Discovery
System Network Configuration Discovery
System Network Connections Discovery
System Owner/User Discovery
System Time Discovery
Software Deployment Tools
Adversary-in-the-Middle (1)
=
Data from Configuration Repository (2)
=
Data from Local System
Input Capture (1)
=
Application Layer Protocol (5)
=
Encrypted Channel (2)
=
Hide Infrastructure
Ingress Tool Transfer
Non-Application Layer Protocol
Proxy (3)
=
Traffic Signaling (1)
=
Automated Exfiltration (1)
=
Exfiltration Over Alternative Protocol (1)
=
Disk Wipe (2)
=
Firmware Corruption
Inhibit System Recovery
System Shutdown/Reboot
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
3 techniques 3 techniques 11 techniques 5 techniques 6 techniques 7 techniques 6 techniques 11 techniques 1 techniques 4 techniques 7 techniques 2 techniques 4 techniques
Exploit Public-Facing Application
=
Valid Accounts (2)
Wi-Fi Networks
=
Command and Scripting Interpreter (3)
Scheduled Task/Job
Software Deployment Tools
=
Account Manipulation (1)
Boot or Logon Autostart Execution
=
Boot or Logon Initialization Scripts (1)
=
Create Account (1)
=
Modify Authentication Process (1)
Power Settings
=
Pre-OS Boot (3)
Scheduled Task/Job
=
Server Software Component (1)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Account Manipulation (1)
Boot or Logon Autostart Execution
=
Boot or Logon Initialization Scripts (1)
Scheduled Task/Job
=
Valid Accounts (2)
Direct Volume Access
=
Indicator Removal (3)
=
Obfuscated Files or Information (1)
=
Pre-OS Boot (3)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Disable or Modify System Firewall (1)
Disable or Modify Tools
=
Modify Authentication Process (1)
=
Modify System Image (2)
=
Network Boundary Bridging (1)
Prevent Command History Logging
=
Weaken Encryption (2)
=
Adversary-in-the-Middle (1)
=
Brute Force (4)
=
Input Capture (1)
=
Modify Authentication Process (1)
Network Sniffing
=
Unsecured Credentials (1)
File and Directory Discovery
Network Service Discovery
Network Sniffing
Password Policy Discovery
Process Discovery
Remote System Discovery
System Information Discovery
System Network Configuration Discovery
System Network Connections Discovery
System Owner/User Discovery
System Time Discovery
Software Deployment Tools
=
Adversary-in-the-Middle (1)
=
Data from Configuration Repository (2)
Data from Local System
=
Input Capture (1)
=
Application Layer Protocol (5)
=
Encrypted Channel (2)
Hide Infrastructure
Ingress Tool Transfer
Non-Application Layer Protocol
=
Proxy (3)
=
Traffic Signaling (1)
=
Automated Exfiltration (1)
=
Exfiltration Over Alternative Protocol (1)
=
Disk Wipe (2)
Firmware Corruption
Inhibit System Recovery
System Shutdown/Reboot