Linux auditd: iptables NAT redirect execution to altered TCP destination ports

Flags iptables NAT REDIRECT commands with --to-ports values 42–43 observed via Linux auditd EXECVE.

FreeReviewedSigma · Medium · v3

Product: linux
Service: auditd
Author: Rafal Piasecki (SigmaHQ), DRL 1.1
Published: 2022-08-10
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of iptables commands that use NAT table redirection to specific destination ports via the --to-ports argument. Such behavior can conceal malicious access by making traffic appear intended for a benign TCP service while redirecting it to an alternate port on the host. Telemetry relies on Linux auditd process execution events (EXECVE) capturing the iptables command line and the presence of the targeted --to-ports values.

Reporting behind it

Related detections9 linkedT1686 — drag to rearrange

Suspicious Disabling or Flushing of the Linux Host Firewall (via process_creation)

Malicious Firewall Deactivation - PowerShell (via powershell)

Malicious Firewall Deactivation - Firewall (via firewall-as)

Suspicious Outbound Firewall Block Rule Added via Netsh Advfirewall

Malicious Windows Firewall Disable via Netsh

OpenSSH Server Firewall Configuration on Windows - Firewall (via firewall-as)

Suspicious Firewall Rule Added Using PowerShell or CMD (via firewall-as)

Suspicious Firewall Rule Masquerading as CloudExperienceHost via netsh

Suspicious Firewall Rule Masquerading As Windows Update (via process_creation)

Linux auditd: iptables NAT redirect execution to altered TCP destination ports

Pivot detection · T1686 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-iptables-nat-redirect-from-attacker-ports-via-bpfdoor-tcp-redirecti-70b4156e

title: "Linux auditd: iptables NAT redirect execution to altered TCP destination ports"
id: e28a5952-1384-4857-8ede-71f363b11906
status: test
description: This rule identifies execution of iptables commands that use NAT table redirection to specific destination ports via the --to-ports argument. Such behavior can conceal malicious access by making traffic appear intended for a benign TCP service while redirecting it to an alternate port on the host. Telemetry relies on Linux auditd process execution events (EXECVE) capturing the iptables command line and the presence of the targeted --to-ports values.
references:
  - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
  - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml
author: Rafal Piasecki, Huntrule Team
date: 2022-08-10
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  service: auditd
detection:
  cmd:
    type: EXECVE
    a0|endswith: iptables
    a1: -t
    a2: nat
  keywords:
    - --to-ports 42
    - --to-ports 43
  condition: cmd and keywords
falsepositives:
  - Legitimate ports redirect
level: medium
license: DRL-1.1
related:
  - id: 70b4156e-50fc-4523-aa50-c9dddf1993fc
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL