Techniques › T1599 › AN0015
AN0015 Analytic 0015
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>From a defender’s perspective, suspicious bridging is observed when network devices begin allowing traffic that contradicts existing segmentation or access policies. Observable behaviors include sudden modifications to ACLs or firewall rules, unusual cross-boundary traffic flows (e.g., east-west communications across separated VLANs), or simultaneous ingress/egress anomalies. Multi-event correlation is key: configuration changes on a router/firewall followed by unexpected traffic patterns, especially from unusual sources, is a strong indicator of compromise.</p>
- Detects
- T1599 Network Boundary Bridging
- Part of
- DET0006 Detection Strategy for Network Boundary Bridging
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| NSM:Flow | Unexpected flows between segmented networks or prohibited ports | DC0078 Network Traffic Flow |
| networkdevice:syslog | ACL/Firewall rule modification or new route injection | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window between configuration changes and abnormal traffic; tuned to match expected administrative change cycles. |
ApprovedChangeList | Known authorized ACL/firewall changes; suppresses noise from legitimate maintenance. |
GeoLocation | Geographic origin of new traffic patterns; helps distinguish benign remote offices from suspicious foreign access. |
TrafficVolumeThreshold | Volume of cross-segment traffic; tuned to detect large-scale lateral flows without flagging small test connections. |