.. /NetBird
Star

Access

NetBird is a WireGuard-based overlay network and zero-trust remote access service that connects peers into a private mesh through NetBird management and signal servers, traversing NAT and firewalls without inbound ports. Threat actors have been observed deploying the NetBird client on compromised hosts to establish persistent, encrypted remote access into internal environments.

Paths:

Resources:

Detections:

Access

  1. Enrolls the host into a NetBird network using a setup key and brings the WireGuard-based tunnel up, joining the host to the attacker-controlled mesh.

    netbird up --setup-key <KEY>
    Use case
    Establishing persistent remote access to a host behind NAT/firewall.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Enrolls the host against a specified (including self-hosted) NetBird management server, joining a custom overlay network controlled by the operator.

    netbird up --management-url <URL> --setup-key <KEY>
    Use case
    Joining a self-hosted NetBird network for remote access.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Shows the status of the NetBird connection and connected peers, confirming the host is reachable within the overlay network.

    netbird status
    Use case
    Verifying remote access into the mesh.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS