Network Address Translation Traversal

let NATConfigPatterns = dynamic([
    "ip nat inside source", "ip nat outside source", "ip nat static",
    "ip nat pool", "no ip nat", "NAT-CREATE", "NAT-DELETE",
    "nat rule added", "nat rule deleted", "nat rule modified",
    "nat policy", "nat translation", "nat overload"
]);
// Source 1: On-premises network devices forwarding syslog to Sentinel
let SyslogNATChanges = Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any (NATConfigPatterns)
| extend ConfigUser = extract(@"by\s+(\S+)\s+on", 1, SyslogMessage)
| extend AccessMethod = extract(@"on\s+(console|vty\d+|aux\d+)", 1, SyslogMessage)
| extend SourceIP = extract(@"\((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\)", 1, SyslogMessage)
| extend IsConfigRemoval = SyslogMessage has_any ("no ip nat", "NAT-DELETE", "nat rule deleted", "nat rule removed")
| project TimeGenerated, DeviceHostname=HostName, DeviceIP=HostIP, EventMessage=SyslogMessage,
          ConfigUser, AccessMethod, SourceIP, IsConfigRemoval, DataSource="Syslog";
// Source 2: CEF events from next-gen firewalls (Palo Alto, Cisco ASA, Fortinet) via CommonSecurityLog
let CEFNATChanges = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceEventCategory has_any ("nat", "NAT", "config", "policy-change")
| where Activity has_any (
    "nat-rule-add", "nat-rule-delete", "nat-rule-edit",
    "config-change", "nat-policy-update", "nat-translation-create",
    "NAT rule created", "NAT rule removed", "NAT rule modified"
  )
| extend IsConfigRemoval = Activity has_any ("delete", "removed", "nat-rule-delete")
| project TimeGenerated, DeviceHostname=DeviceName, DeviceIP=DeviceAddress, EventMessage=Message,
          ConfigUser=DestinationUserName, AccessMethod="API/Console",
          SourceIP=tostring(SourceIP), IsConfigRemoval, DataSource=DeviceVendor;
// Source 3: Azure NAT Gateway and Azure Firewall rule changes
let AzureNATChanges = AzureActivity
| where TimeGenerated > ago(24h)
| where ResourceProviderValue =~ "MICROSOFT.NETWORK"
| where OperationNameValue has_any (
    "natGateways/write", "natGateways/delete",
    "azureFirewalls/write",
    "firewallPolicies/ruleCollectionGroups/write",
    "firewallPolicies/ruleCollectionGroups/delete"
  )
| where ActivityStatusValue =~ "Success"
| extend IsConfigRemoval = OperationNameValue has_any ("delete", "Delete")
| project TimeGenerated, DeviceHostname=ResourceGroup, DeviceIP=CallerIpAddress,
          EventMessage=OperationNameValue, ConfigUser=Caller,
          AccessMethod="Azure Portal/API", SourceIP=CallerIpAddress,
          IsConfigRemoval, DataSource="AzureActivity";
// Combine all NAT change events across hybrid environment
union SyslogNATChanges, CEFNATChanges, AzureNATChanges
| sort by TimeGenerated desc

(index=network OR index=firewall) sourcetype IN ("syslog", "cisco:ios", "cisco:asa", "pan:log", "juniper:junos", "fortinet:fortigate:traffic", "fortinet:fortigate:event")
  (
    "ip nat inside" OR "ip nat outside" OR "ip nat static" OR
    "ip nat pool" OR "no ip nat" OR "NAT-CREATE" OR "NAT-DELETE" OR
    "nat rule" OR "nat policy" OR "nat translation" OR "nat overload"
  )
| eval NATOperation=case(
    match(_raw, "ip nat inside source"), "Inside Source NAT Configured",
    match(_raw, "ip nat outside source"), "Outside Source NAT Configured",
    match(_raw, "no ip nat"), "NAT Rule Removed",
    match(_raw, "ip nat static"), "Static NAT Configured",
    match(_raw, "ip nat pool"), "Dynamic NAT Pool Configured",
    match(_raw, "(?i)NAT-CREATE"), "NAT Translation Created",
    match(_raw, "(?i)NAT-DELETE"), "NAT Translation Deleted",
    match(_raw, "(?i)nat rule.{0,20}(add|creat|insert)"), "NAT Rule Added",
    match(_raw, "(?i)nat rule.{0,20}(delet|remov)"), "NAT Rule Deleted",
    match(_raw, "(?i)nat rule.{0,20}(modif|edit|chang)"), "NAT Rule Modified",
    true(), "NAT Configuration Event"
  )
| rex field=_raw "by\s+(?<ConfigUser>\S+)\s+on"
| rex field=_raw "on\s+(?<AccessMethod>console|vty\d+|aux\d+)"
| rex field=_raw "\((?<ConfigSourceIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\)"
| eval IsHighRisk=if(
    match(_raw, "(?i)(no ip nat|NAT-DELETE|nat rule.{0,20}(delet|remov))") OR
    (isnull(ConfigUser) OR ConfigUser="") OR
    match(AccessMethod, "vty"),
    1, 0
  )
| eval IsAfterHours=if(
    (tonumber(strftime(_time, "%H")) < 6 OR tonumber(strftime(_time, "%H")) >= 22),
    1, 0
  )
| table _time, host, NATOperation, ConfigUser, AccessMethod, ConfigSourceIP, IsHighRisk, IsAfterHours, sourcetype, _raw
| sort - _time

// T1599.001 — NAT Traversal
any where event.dataset : "network_traffic.firewall"
  and event.action in ("config_change", "nat_rule_modified", "rule_change")
  and message : (
    "ip nat inside source", "ip nat outside source", "ip nat static",
    "ip nat pool", "no ip nat", "NAT-CREATE", "NAT-DELETE",
    "nat rule added", "nat rule deleted", "nat rule modified"
  )

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "EventTime",
    LOGSOURCENAME(logsourceid) AS "LogSource",
    LOGSOURCETYPENAME(devicetype) AS "LogSourceType",
    "username", "sourceip", "destinationip",
    "eventid", "deviceaction", "message",
    CASE
        WHEN LOWER("message") ILIKE '%ip nat inside source%' OR LOWER("message") ILIKE '%nat-create%' OR LOWER("message") ILIKE '%nat-delete%' OR LOWER("message") ILIKE '%nat rule added%' THEN 8
        ELSE 4
      END AS "RiskScore"
  FROM events
  WHERE (LOWER("message") ILIKE '%ip nat inside source%' OR LOWER("message") ILIKE '%nat-create%' OR LOWER("message") ILIKE '%nat-delete%' OR LOWER("message") ILIKE '%nat rule added%')
    AND LOGSOURCETYPENAME(devicetype) NOT IN ('SIM Audit', 'Custom Rule Engine')
  ORDER BY "RiskScore" DESC, "EventTime" DESC
  LAST 24 HOURS

_sourceCategory=*firewall* OR _sourceCategory=*network*
| json auto
| where !(src_ip matches "10.*") and !(src_ip matches "192.168.*")
| count by src_ip, dest_ip, dest_port
| sort by _count desc

rule t1599_001_network_address_translation_tr {
  meta:
    author = "df00tech"
    description = "Detects Network Address Translation Traversal (T1599.001)"
    mitre_attack_tactic = "TA0043"
    mitre_attack_technique = "T1599.001"
    confidence = "medium"
    severity = "high"
  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.principal.ip != ""
  condition:
    $e
}

#event_simpleName in ["NetworkConnectIP4", "NetworkConnectIP6"]
| not RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| groupBy([RemoteAddressIP4], function=count(as=TotalConns))
| TotalConns > 100
| TechniqueLabel := "T1599.001 - Reconnaissance"
| table([@timestamp, RemoteAddressIP4, TotalConns, TechniqueLabel])