Linux Firewall Rule Deletions via iptables, firewall-cmd, ufw, or nft

title: Linux Firewall Rule Deletions via iptables, firewall-cmd, ufw, or nft
id: 2735cfca-9b4d-4fac-b145-2502541f5996
related:
  - id: 53059bc0-1472-438b-956a-7508a94a91f0
    type: similar
  - id: 323ff3f5-0013-4847-bbd4-250b5edb62cc
    type: derived
status: test
description: "This rule identifies Linux processes executing firewall-rule removal actions using common firewall utilities: iptables (commands containing DROP), firewall-cmd (commands containing remove), ufw (commands containing delete), and nft (commands containing delete/flush). Such activity matters because adversaries can impair network access controls by deleting or flushing firewall rules to bypass restrictions. Telemetry relies on auditd EXECVE events capturing the executed binary and its command arguments."
references:
  - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
  - https://blog.aquasec.com/container-security-tnt-container-attack
  - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml
author: IAI, Huntrule Team
date: 2023-03-06
modified: 2025-10-12
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  service: auditd
detection:
  selection1:
    type: EXECVE
    a0: iptables
    a1|contains: DROP
  selection2:
    type: EXECVE
    a0: firewall-cmd
    a1|contains: remove
  selection3:
    type: EXECVE
    a0: ufw
    a1|contains: delete
  selection4:
    type: EXECVE
    a0: nft
    a1|contains:
      - delete
      - flush
  condition: 1 of selection*
falsepositives:
  - Legitimate admin activity
level: medium
license: DRL-1.1