Techniques › T1599.001 › AN0465
AN0465 Analytic 0465
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders may observe unauthorized or anomalous changes to NAT configurations, including the addition of new translation rules or modifications to existing ones. Suspicious behaviors include sudden introduction of NAT mappings bridging segmented networks, new port address translation rules that obscure true source IPs, or traffic flows inconsistent with expected network design. Multi-event correlation includes detecting configuration changes on routers/firewalls, followed by traffic traversing unexpected internal/external address pairs.</p>
- Detects
- T1599.001 Network Address Translation Traversal
- Part of
- DET0163 Detection Strategy for Network Address Translation Traversal
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:config | NAT table modification (add/update/delete rule) | DC0085 Network Traffic Content |
| NSM:Flow | Source/destination IP translation inconsistent with intended policy | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Time correlation window between NAT rule change and unexpected traffic; adjustable to align with change management practices. |
AuthorizedNATRules | Whitelist of approved NAT policies and rules; prevents false positives from legitimate operations. |
TrafficVolumeThreshold | Threshold for abnormal traffic across NAT; tuned to differentiate testing from large-scale exfiltration or bridging. |
InterfaceScope | Specific interfaces or zones monitored for NAT translation; allows tuning for internal vs. external-facing boundaries. |