Splunk unknown stable spl

Linux Auditd Disable Or Modify System Firewall

The following analytic detects the suspicious disable or modify system firewall. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.

View Source

Detection Logic

`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw")
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
    BY type pid comm
       exe unit dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_disable_or_modify_system_firewall_filter`

False Positives

⚠ Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.

Field Validations

Loading…

Comments (0)

Loading comments...