Iptables Redirection Rule Creation

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

This rule detects the execution of iptables or xtables commands to create a network redirection rule. Specifically, it looks for commands that use 'REDIRECT', '--to-ports', and either 'PREROUTING' or 'nat' in the command line, indicating an attempt to redirect network traffic, potentially for proxying or other malicious network manipulation.