Linux UFW Disable Attempt via Process Execution

Flags Linux commands that stop/flush/unload or disable UFW, reducing firewall protection and exposure.

FreeReviewedSigma · Medium · v3

Product: linux
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-01-18
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process executions attempting to disable or stop the Uncomplicated Firewall (UFW). It matches command lines containing UFW disable actions (including the `ufw disable` form and the `systemctl disable ufw` form) and `ufw-init` stop/flush/force-stop sequences that unload or reset firewall state. Disabling UFW can reduce host network protection, and the detection relies on Linux process creation telemetry with command-line details.

Reporting behind it

Related detections9 linkedT1686 — drag to rearrange

Suspicious Windows Firewall Rule Creation Masquerading as Network Discovery (via process_creation)

Suspicious Firewall Flush via iptables in Kinsing Intrusion

Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware

Suspicious iptables Port Redirect Rule via GRIMBOLT

Suspicious Firewall Allow Rule for TightVNC Server via netsh (via process_creation)

Suspicious Firewall Rule Added to Open RDP Port 3389 via netsh

Suspicious VMware PCI Device Disabled via Devcon

Possible Firewall Rule Manipulation via netsh advfirewall by FishMonger

Suspicious netsh Firewall Rule Masquerading as SSTP HTTP

Linux UFW Disable Attempt via Process Execution

Pivot detection · T1686 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-attempt-to-disable-or-stop-ufw-firewall-via-ufw-init-or-ufw-disable-84c9e83c

title: Linux UFW Disable Attempt via Process Execution
id: 2b7341d4-8fa3-4ad0-bc38-81a0e454b68e
status: test
description: This rule identifies Linux process executions attempting to disable or stop the Uncomplicated Firewall (UFW). It matches command lines containing UFW disable actions (including the `ufw disable` form and the `systemctl disable ufw` form) and `ufw-init` stop/flush/force-stop sequences that unload or reset firewall state. Disabling UFW can reduce host network protection, and the detection relies on Linux process creation telemetry with command-line details.
references:
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html
  - https://www.cyberciti.biz/faq/linux-disable-firewall-command/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-18
modified: 2026-05-04
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  category: process_creation
detection:
  selection_ufw_init:
    Image|endswith: /ufw-init
    CommandLine|contains:
      - " force-stop"
      - " stop"
      - " flush"
  selection_ufw_disable:
    CommandLine|contains|all:
      - "ufw "
      - disable
  condition: 1 of selection_*
falsepositives:
  - Legitimate actions by system administrators to disable UFW.
level: medium
license: DRL-1.1
related:
  - id: 84c9e83c-599a-458a-a0cb-0ecce44e807a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL