Dahua PTCP Tunnel Loopback Bind-Request (Inverted-STUN NAT Traversal)

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•2

This rule detects potentially malicious network activity involving Dahua PTCP protocol packets that specifically request a loopback bind (127.0.0.1) using an inverted-STUN style mechanism. This behavior is indicative of an adversary attempting to bypass network segmentation or perform local service proxying/tunneling to maintain command and control or enable unauthorized access to internal services on the target device.