T1599 Network Boundary Bridging Mappings

Adversaries may bridge network boundaries by compromising perimeter network devices. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks. They achieve this by restricting traffic types to enforce organizational policy in an attempt to reduce the risk inherent in such connections. Restriction of traffic can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications. To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised.

When an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance. By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want, allowing them to then further achieve goals such as command and control via Multi-hop Proxy or exfiltration of data via Traffic Duplication. In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-2 Account Management Protects T1599 Network Boundary Bridging
AC-3 Access Enforcement Protects T1599 Network Boundary Bridging
AC-4 Information Flow Enforcement Protects T1599 Network Boundary Bridging
AC-5 Separation of Duties Protects T1599 Network Boundary Bridging
AC-6 Least Privilege Protects T1599 Network Boundary Bridging
CA-7 Continuous Monitoring Protects T1599 Network Boundary Bridging
CM-2 Baseline Configuration Protects T1599 Network Boundary Bridging
CM-5 Access Restrictions for Change Protects T1599 Network Boundary Bridging
CM-6 Configuration Settings Protects T1599 Network Boundary Bridging
CM-7 Least Functionality Protects T1599 Network Boundary Bridging
IA-2 Identification and Authentication (organizational Users) Protects T1599 Network Boundary Bridging
IA-5 Authenticator Management Protects T1599 Network Boundary Bridging
SC-28 Protection of Information at Rest Protects T1599 Network Boundary Bridging
SC-7 Boundary Protection Protects T1599 Network Boundary Bridging
SI-10 Information Input Validation Protects T1599 Network Boundary Bridging
SI-15 Information Output Filtering Protects T1599 Network Boundary Bridging
SI-4 System Monitoring Protects T1599 Network Boundary Bridging
SI-7 Software, Firmware, and Information Integrity Protects T1599 Network Boundary Bridging
action.hacking.variety.Unknown Unknown related-to T1599 Network Boundry Bridging
amazon_inspector Amazon Inspector technique_scores T1599 Network Boundary Bridging

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1599.001 Network Address Translation Traversal 20