T1599 Network Boundary Bridging via Route Addition or IP Forwarding

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•1

Detects command-line execution of tools (route, netsh, sysctl) intended to modify host routing tables or enable IP forwarding. Such activity on workstation endpoints may indicate an attempt to bridge network segments, bypass network security boundaries, or facilitate lateral movement/C2 communications.