Network Address Translation Traversal (T1599.001) is a sub-technique of Network Boundary Bridging, in the Defense Impairment tactic, for the Network Devices platform.
NAT rewrites the source or destination addresses in IP headers as packets pass between networks. Many designs depend on it, for example when internal networks use non-Internet routable addresses.
How attackers use it
MITRE says that with control of a boundary device, an adversary may modify NAT configuration to send traffic between separated networks, or to obscure their activity.
Where a design needs NAT to function, those changes overcome routing limits that would otherwise prevent reaching protected systems behind the device. Where it does not, address translation can still make monitoring harder, since changing packet addresses at a boundary muddies what you see.
MITRE adds that an adversary may use Patch System Image to change the operating system of a device and run their own custom NAT mechanisms.
How to detect it
MITRE's detection strategy points at unauthorized or anomalous NAT configuration changes, such as new translation rules or edits to existing ones. Suspicious signs include:
- NAT mappings that suddenly bridge segmented networks.
- New port address translation rules that obscure true source addresses.
- Traffic flows that do not fit the expected network design.
Correlate a configuration change on the router or firewall with traffic crossing unexpected internal and external address pairs.
How to reduce the risk
MITRE lists these mitigations: follow NIST guidance for password policies, keep local device passwords encrypted where supported, require multi-factor authentication for user and privileged accounts through TACACS+ or RADIUS, restrict administrators to as few people as possible without credential overlap with other platforms, and, when a compromised device is found, block the malicious packets using an unaffected device in the path.
Check your own environment
On a Cisco IOS device, list current NAT translations and configured rules (read-only; confirm syntax for your platform):
show ip nat translations
show running-config | include ip nat
Compare the results with your documented NAT design.
Quick check
Why would an adversary change NAT on a network that does not need it?
To obscure activity, because rewriting packet addresses at a boundary can make traffic harder to monitor.
