TA0005 · DEFENSE EVASION
Network Boundary Bridging
Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation.
Detect it with
Consider monitoring network traffic on both interfaces of border network devices with out-of-band packet capture or network flow data, using a different device than the one in question.
Why it matters on shift
Network Boundary Bridging is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
1 sub-techniques
How it shows up in practice
Kill-chain context