Newly Observed IPSEC NAT Traversal Peer

  1[metadata]
  2creation_date = "2020/02/18"
  3integration = ["network_traffic", "panw", "pfsense", "zeek"]
  4maturity = "production"
  5min_stack_comments = "MV_CONTAINS was added to ES|QL in 9.2.0 and is not available on 8.19; 9.3.0 is the lowest supported 9.x release."
  6min_stack_version = "9.3.0"
  7updated_date = "2026/09/22"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12This rule identifies outbound IPSEC NAT Traversal (NAT-T) traffic to an external destination IP that was not observed
 13during the previous 5 days. IPSEC is a VPN technology that allows one system to talk to another using encrypted
 14tunnels. NAT Traversal encapsulates IPSEC ESP traffic in UDP and, once a NAT device is detected, both peers float to UDP
 15port 4500 for the tunnel data channel. Newly observed external NAT-T peers may indicate unauthorized VPN use or an
 16adversary tunneling command and control or exfiltration traffic over the Internet.
 17"""
 18false_positives = [
 19    """
 20    Newly deployed legitimate site-to-site or client VPN gateways, or established gateways that were inactive for more
 21    than 5 days, will generate an alert when first observed. Where these peers are expected, their external destination
 22    IP addresses can be excluded.
 23    """,
 24]
 25from = "now-7205m"
 26interval = "5m"
 27language = "esql"
 28license = "Elastic License v2"
 29name = "Newly Observed IPSEC NAT Traversal Peer"
 30risk_score = 21
 31rule_id = "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7"
 32severity = "low"
 33tags = [
 34    "Tactic: Command and Control",
 35    "Domain: Endpoint",
 36    "Use Case: Threat Detection",
 37    "Data Source: PAN-OS",
 38    "Data Source: Network Traffic",
 39    "Data Source: pfSense",
 40    "Data Source: Zeek",
 41    "Resources: Investigation Guide",
 42    "Rule Type: ES|QL",
 43    "Domain: Network",
 44    "Data Source: Network Packet Capture",
 45]
 46timestamp_override = "event.ingested"
 47type = "esql"
 48
 49query = '''
 50FROM packetbeat-*, auditbeat-*, filebeat-*, logs-network_traffic.flow-*, logs-panw.panos*, logs-pfsense.log-*, logs-zeek.connection-* METADATA _id
 51| WHERE (
 52    data_stream.dataset IN ("network_traffic.flow", "zeek.connection")
 53    OR MV_CONTAINS(event.category, "network")
 54    OR MV_CONTAINS(event.category, "network_traffic")
 55  )
 56  AND network.transport == "udp"
 57  AND source.port == 4500
 58  AND destination.port == 4500
 59  AND CIDR_MATCH(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
 60  AND NOT CIDR_MATCH(
 61    destination.ip,
 62    "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
 63    "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
 64    "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
 65    "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
 66    "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
 67    "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
 68  )
 69  AND (
 70    data_stream.dataset IS NULL
 71    OR data_stream.dataset != "panw.panos"
 72    OR event.action IS NULL
 73    OR event.action NOT IN ("flow_dropped", "flow_denied")
 74  )
 75| EVAL Esql.dataset = COALESCE(data_stream.dataset, event.dataset)
 76| STATS
 77    Esql.first_seen = MIN(@timestamp),
 78    Esql.last_seen = MAX(@timestamp),
 79    Esql.event_count = COUNT(*),
 80    Esql.source_ip_count = COUNT_DISTINCT(source.ip),
 81    Esql.source_ip_values = MV_SLICE(VALUES(source.ip), 0, 100),
 82    Esql.event_action_values = VALUES(event.action),
 83    Esql.dataset_values = VALUES(Esql.dataset),
 84    Esql.observer_name_values = MV_SLICE(VALUES(observer.name), 0, 20)
 85  BY destination.ip
 86| EVAL Esql.recent = DATE_DIFF("minute", Esql.first_seen, NOW())
 87| WHERE Esql.recent >= 0 AND Esql.recent <= 10
 88| KEEP destination.ip, Esql.*
 89'''
 90note = """## Triage and analysis
 91
 92> **Disclaimer**:
 93> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 94
 95### Investigating Newly Observed IPSEC NAT Traversal Peer
 96
 97IPSEC NAT Traversal facilitates secure VPN communication across NAT devices by encapsulating IPSEC packets in UDP, typically using port 4500. While essential for legitimate encrypted traffic, adversaries exploit this to mask malicious activities and bypass network defenses. This rule surfaces an external destination the first time NAT-T traffic to it is observed within a 5-day history window.
 98
 99### Possible investigation steps
100
101- Review the source and destination IP addresses associated with the UDP traffic on port 4500 to determine if they are known or expected within your network environment.
102- Analyze the volume and frequency of the detected traffic to assess whether it aligns with typical IPSEC NAT Traversal usage or if it appears anomalous.
103- Check for any associated network traffic events in the same timeframe that might indicate a pattern of suspicious activity, such as unusual data transfer volumes or connections to known malicious IP addresses.
104- Investigate the endpoint or device generating the traffic to verify if it is authorized to use IPSEC NAT Traversal and if it has any history of security incidents or vulnerabilities.
105- Correlate the detected activity with any recent changes in network configurations or security policies that might explain the traffic pattern.
106- Consult threat intelligence sources to determine if the destination IP address or domain has been associated with known threat actors or command and control infrastructure.
107
108### False positive analysis
109
110- A legitimate VPN gateway will alert when it is first deployed or first observed after more than 5 days of inactivity.
111- Legitimate VPN traffic using IPSEC NAT Traversal can trigger alerts. Regularly review and whitelist known IP addresses or subnets associated with authorized VPN connections to reduce false positives.
112- Network devices or services that rely on IPSEC for secure communication may generate expected traffic on port 4500. Identify and document these devices, then create exceptions in the detection rule to prevent unnecessary alerts.
113- Automated backup or synchronization services that use IPSEC for secure data transfer might be flagged. Monitor these services and exclude their traffic patterns if they are verified as non-threatening.
114- Some enterprise applications may use IPSEC NAT Traversal for secure communication. Conduct an inventory of such applications and adjust the rule to exclude their traffic after confirming their legitimacy.
115- Regularly update the list of known safe IP addresses and services to ensure that new legitimate sources of IPSEC NAT Traversal traffic are promptly excluded from triggering alerts.
116
117### Response and remediation
118
119- Immediately isolate the affected system from the network to prevent further potential malicious activity and lateral movement.
120- Conduct a thorough analysis of the isolated system to identify any signs of compromise, such as unauthorized access or data exfiltration, focusing on logs and network traffic related to UDP port 4500.
121- Block all suspicious IP addresses associated with the detected traffic on port 4500 at the network perimeter to prevent further communication with potential threat actors.
122- Review and update firewall and intrusion detection/prevention system (IDS/IPS) rules to ensure they effectively block unauthorized IPSEC NAT Traversal traffic, particularly on UDP port 4500.
123- Restore the affected system from a known good backup if any signs of compromise are confirmed, ensuring that all security patches and updates are applied before reconnecting to the network.
124- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
125- Implement enhanced monitoring and logging for UDP traffic on port 4500 to detect and respond to any future suspicious activity promptly."""
126
127
128[rule.alert_suppression]
129group_by = ["destination.ip"]
130missing_fields_strategy = "suppress"
131
132[rule.alert_suppression.duration]
133unit = "h"
134value = 24
135
136[[rule.threat]]
137framework = "MITRE ATT&CK"
138[[rule.threat.technique]]
139id = "T1095"
140name = "Non-Application Layer Protocol"
141reference = "https://attack.mitre.org/techniques/T1095/"
142
143[[rule.threat.technique]]
144id = "T1572"
145name = "Protocol Tunneling"
146reference = "https://attack.mitre.org/techniques/T1572/"
147
148[[rule.threat.technique]]
149id = "T1573"
150name = "Encrypted Channel"
151reference = "https://attack.mitre.org/techniques/T1573/"
152
153
154[rule.threat.tactic]
155id = "TA0011"
156name = "Command and Control"
157reference = "https://attack.mitre.org/tactics/TA0011/"