Linux Attempt to Disable or Stop UFW Firewall via ufw-init or ufw disable

Flags Linux commands that stop/flush/unload or disable UFW, reducing firewall protection and exposure.

FreeUnreviewedSigmamediumv1

linux-attempt-to-disable-or-stop-ufw-firewall-via-ufw-init-or-ufw-disable-84c9e83c

title: Linux Attempt to Disable or Stop UFW Firewall via ufw-init or ufw disable
id: 2b7341d4-8fa3-4ad0-bc38-81a0e454b68e
status: test
description: This rule detects Linux process executions where the command line attempts to stop, unload, flush, or disable Uncomplicated Firewall (UFW). Attackers may impair defenses by stopping active firewall enforcement or preventing UFW from starting at boot, increasing exposure of network services. The detection relies on process creation telemetry, matching command-line arguments for ufw-init actions (stop/force-stop/flush) and for ufw disable/systemctl disable patterns.
references:
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html
  - https://www.cyberciti.biz/faq/linux-disable-firewall-command/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-18
modified: 2026-05-04
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  category: process_creation
detection:
  selection_ufw_init:
    Image|endswith: /ufw-init
    CommandLine|contains:
      - " force-stop"
      - " stop"
      - " flush"
  selection_ufw_disable:
    CommandLine|contains|all:
      - "ufw "
      - disable
  condition: 1 of selection_*
falsepositives:
  - Legitimate actions by system administrators to disable UFW.
level: medium
license: DRL-1.1
related:
  - id: 84c9e83c-599a-458a-a0cb-0ecce44e807a
    type: derived

What it detects

This rule detects Linux process executions where the command line attempts to stop, unload, flush, or disable Uncomplicated Firewall (UFW). Attackers may impair defenses by stopping active firewall enforcement or preventing UFW from starting at boot, increasing exposure of network services. The detection relies on process creation telemetry, matching command-line arguments for ufw-init actions (stop/force-stop/flush) and for ufw disable/systemctl disable patterns.

Known false positives

Legitimate actions by system administrators to disable UFW.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.