T1601 Modify System Image
EnterpriseAdversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (2)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (2)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.PSPlatform Securitymoderate · backed by 11 of 24 mapped controls
- ID.RARisk Assessmentmoderate · backed by 8 of 24 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 7 of 24 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (24)
Security controls that mitigate this.
known-exploited CVEs (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-44168US | high7.8OT critical | KEV | ||
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbit… | ||||
software (1)
Malware and tools associated with this.
source
Where this definition is published.