Elastic Security Detection Rules

IPSEC NAT Traversal Port Activity

Last updated 9 months ago on 2025-01-15
Created 6 years ago on 2020-02-18

About

This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection.
Tags
Tactic: Command and ControlDomain: EndpointUse Case: Threat DetectionData Source: PAN-OSLanguage: kuery
Severity
low
Risk Score
21
MITRE ATT&CK™

Command and Control (TA0011)(opens in a new tab or window)

False Positive Examples
Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded.
License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
packetbeat-*auditbeat-*filebeat-*logs-network_traffic.*logs-panw.*
Related Integrations

network_traffic(opens in a new tab or window)

panw(opens in a new tab or window)

Query
(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and network.transport:udp and destination.port:4500

Install detection rules in Elastic Security

Detect IPSEC NAT Traversal Port Activity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).