Linux auditd: iptables NAT REDIRECT from attacker ports via Bpfdoor TCP redirection

Flags iptables NAT REDIRECT commands with --to-ports values 42–43 observed via Linux auditd EXECVE.

FreeUnreviewedSigmamediumv1

linux-auditd-iptables-nat-redirect-from-attacker-ports-via-bpfdoor-tcp-redirecti-70b4156e

title: "Linux auditd: iptables NAT REDIRECT from attacker ports via Bpfdoor TCP redirection"
id: e28a5952-1384-4857-8ede-71f363b11906
status: test
description: This rule matches executions of iptables with NAT mode redirection behavior, specifically when the command line includes destination port redirection values in the 42–43 range. Attackers can abuse NAT/REDIRECT to steer traffic that appears destined for a standard service (e.g., TCP 22) to an alternate backend port, aiding stealth and evasion. It relies on Linux auditd EXECVE telemetry capturing the iptables binary invocation and its command-line arguments.
references:
  - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
  - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml
author: Rafal Piasecki, Huntrule Team
date: 2022-08-10
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  service: auditd
detection:
  cmd:
    type: EXECVE
    a0|endswith: iptables
    a1: -t
    a2: nat
  keywords:
    - --to-ports 42
    - --to-ports 43
  condition: cmd and keywords
falsepositives:
  - Legitimate ports redirect
level: medium
license: DRL-1.1
related:
  - id: 70b4156e-50fc-4523-aa50-c9dddf1993fc
    type: derived

What it detects

This rule matches executions of iptables with NAT mode redirection behavior, specifically when the command line includes destination port redirection values in the 42–43 range. Attackers can abuse NAT/REDIRECT to steer traffic that appears destined for a standard service (e.g., TCP 22) to an alternate backend port, aiding stealth and evasion. It relies on Linux auditd EXECVE telemetry capturing the iptables binary invocation and its command-line arguments.

Known false positives

Legitimate ports redirect

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.