The best way to identify if a device is vulnerable or actively being leveraged for UPnProxying is to scan the endpoint and audit your NAT table entries.

brute_upnproxy.sh

#!/bin/bash
url=$1
soap_head='<?xml version="1.0" encoding="utf-8"?><s:Envelopes:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><u:GetGenericPortMappingEntry xmlns:u="urn:upnporg:serviceId:WANIPConnection.1#GetGenericPortMappingEntry"><NewPortMappingIndex>'soap_tail='</NewPortMappingIndex></u:GetGenericPortMappingEntry></s:Body></s:Envelope>'
for i in `seq 1 1000`; do
  payload=$soap_head$i$soap_tail
  curl -H 'Content-Type: "text/xml;charset=UTF-8"' -H 'SOAPACTION: "urn:schemasupnp-org:service:WANIPConnection:1#GetGenericPortMappingEntry"'--data "$payload"
"$url"
  echo ""
done