Syslog Forwarding Tampering via iptables_ufw - *nix [splunk-edr]

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems. This use case identifies iptables or UFW commands to modify configurations to block outgoing packets directed to syslog ports.