T1599.001 — Network Address Translation Traversal

Tactic: Defense Impairment · Platforms: Network Devices

Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks. Network devices such…

Sub-technique of Network Boundary Bridging (T1599).

Sigma detection rules (1)

T1599.001 Network Boundary Bridging: Network Address Translation Traversal

title: "T1599.001 Network Boundary Bridging: Network Address Translation Traversal"
id: b21fefdb-5408-4a17-9197-cfb22f052f38
description: 'Detection Strategy for Network Address Translation Traversal. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: TimeWindow, AuthorizedNATRules, TrafficVolumeThreshold, InterfaceScope.'
references:
  - https://attack.mitre.org/techniques/T1599/001
author: Shahrukh Khan
date: 2026-01-23
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1599.001

logsource:
  product: networkdevice
  service: config

detection:
  selection_nat_change:
    Message|contains:
      - 'ip nat'
      - 'nat rule'
      - 'set nat'
      - 'no ip nat'
  selection_disable:
    Message|contains:
      - 'no ip access-group'
      - 'no ip inspect'
      - 'security-policy disable'
  condition: 1 of selection_*

falsepositives:
  - Legitimate NAT rule updates during a planned addressing change or firewall policy migration.

level: high

Explore