Detect Network Address Translation Traversal in CrowdStrike LogScale
Adversaries may bridge network boundaries by modifying a network device's Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks. Network devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks. When performing NAT, the network device rewrites source and/or destination addresses of the IP address header. An adversary who gains control of a network boundary device may modify NAT configurations to send traffic between two separated networks or to obscure their activities by changing the addresses of packets traversing the border device, making traffic monitoring more challenging for defenders. Adversaries may combine this technique with Patch System Image (T1601.001) to implement persistent custom NAT mechanisms within compromised device firmware.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1599 Network Boundary Bridging
- Sub-technique
- T1599.001 Network Address Translation Traversal
- Canonical reference
- https://attack.mitre.org/techniques/T1599/001/
LogScale Detection Query
#event_simpleName in ["NetworkConnectIP4", "NetworkConnectIP6"]
| not RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| groupBy([RemoteAddressIP4], function=count(as=TotalConns))
| TotalConns > 100
| TechniqueLabel := "T1599.001 - Reconnaissance"
| table([@timestamp, RemoteAddressIP4, TotalConns, TechniqueLabel])CrowdStrike LogScale (Falcon) CQL detection for Network Address Translation Traversal (T1599.001). Uses CrowdStrike event simpleName taxonomy with regex-based field filtering, groupBy aggregation, and case-based risk classification. Designed for the Falcon platform's LogScale query language.
Data Sources
Required Tables
False Positives & Tuning
- Authorized network engineers making planned NAT changes during approved change management windows — correlate against change tickets before escalating
- Automated configuration management tools (Ansible, Terraform, Cisco DNA Center, NetBox) applying approved network configurations on a scheduled basis
- Cloud infrastructure automation scripts creating or modifying Azure NAT Gateways as part of normal CI/CD deployment pipelines
- Network device reboots restoring previously configured NAT rules that trigger repeated SYS-5-CONFIG_I log events from startup config application
Other platforms for T1599.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Linux iptables NAT Rule Addition — Simulate Cross-Segment Bridging
Expected signal: Linux auditd: SYSCALL events for write() to /proc/sys/net/ipv4/ip_forward and execve() of /sbin/iptables with '-t nat -A' arguments. If auditd rules watch execve of iptables: USER_CMD or EXECVE audit events with args including '-t', 'nat', 'MASQUERADE', 'DNAT'. Syslog: kernel netfilter messages if kernel logging is enabled. SIEM: Syslog events from the host containing 'iptables' and 'nat' keywords matching the detection query.
- Test 2Linux nftables NAT Table Creation and Rule Insertion
Expected signal: Linux auditd: execve() events for /usr/sbin/nft binary with arguments containing 'nat', 'masquerade', 'dnat'. Syslog: kernel netfilter messages if kernel logging configured. If auditd EXECVE rules watch nft: EXECVE records showing the full nft command arguments. SIEM: Syslog events from host matching 'nft' combined with 'nat' or 'masquerade'.
- Test 3Cisco IOS NAT Rule Injection via SSH Expect Script
Expected signal: Cisco IOS syslog: SYS-5-CONFIG_I message — 'Configured from vty0 (ATTACKER_IP) by ADMIN_USER' — emitted immediately after the configuration session ends. TACACS+ accounting log (if enabled): command records for 'configure terminal', 'ip nat inside source static 10.10.0.100 203.0.113.100', and 'end' attributed to ADMIN_USER from the source IP. Device SSH log: accepted authentication event for ADMIN_USER from the expect script's source IP.
- Test 4Python Netmiko — Automated NAT Policy Modification on Network Device
Expected signal: Cisco IOS syslog: SYS-5-CONFIG_I event — 'Configured from vty0 (SCRIPT_HOST_IP) by admin' — emitted when send_config_set() completes. TACACS+ accounting: individual command records for each NAT command sent by Netmiko, attributed to the admin account from the script host IP. Network device SSH connection logs: new SSH session from the Python script's host IP. SIEM: Syslog events containing 'ip nat' from the device coinciding with the SSH session from the non-NMS source IP.
References (11)
- https://attack.mitre.org/techniques/T1599/001/
- https://tools.ietf.org/html/rfc1918
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book/iadnat-addr-consrvtn.html
- https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/syslog
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/commonsecuritylog
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity
- https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.html
- https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)
- https://github.com/ktbyers/netmiko
- https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-strong-security-controls-network-infrastructure-devices-508c.pdf
Unlock Pro Content
Get the full detection package for T1599.001 including response playbook, investigation guide, and atomic red team tests.