Sigma medium test sigma

Modify System Firewall

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

View Source

Detection Logic

{
  "selection1": {
    "type": "EXECVE",
    "a0": "iptables",
    "a1
| contains": "DROP"
  },
  "selection2": {
    "type": "EXECVE",
    "a0": "firewall-cmd",
    "a1
| contains": "remove"
  },
  "selection3": {
    "type": "EXECVE",
    "a0": "ufw",
    "a1
| contains": "delete"
  },
  "selection4": {
    "type": "EXECVE",
    "a0": "nft",
    "a1
| contains": [
      "delete",
      "flush"
    ]
  },
  "condition": "1 of selection*"
}

False Positives

⚠ Legitimate admin activity

Field Validations

Loading…

Comments (0)

Loading comments...