Linux firewall rule deletion via iptables, firewall-cmd, ufw, or nft

Flags EXECVE activity that removes Linux firewall rules using iptables, firewall-cmd, ufw, or nft.

FreeReviewedSigma · Medium · v3

Product: linux
Service: auditd
Author: IAI (SigmaHQ), DRL 1.1
Published: 2023-03-06
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux processes attempting to delete or remove system firewall rules by matching execve activity for iptables DROP operations, firewall-cmd remove commands, ufw delete commands, and nft delete/flush commands. Removing firewall rules can weaken network access controls and enable evasion or unauthorized communication. It relies on auditd telemetry capturing process execution details (process name and command arguments) for these firewall management tools.

Reporting behind it

Related detections9 linkedT1686 — drag to rearrange

Suspicious Disabling or Flushing of the Linux Host Firewall (via process_creation)

Malicious Firewall Deactivation - PowerShell (via powershell)

Malicious Firewall Deactivation - Firewall (via firewall-as)

Suspicious Outbound Firewall Block Rule Added via Netsh Advfirewall

Malicious Windows Firewall Disable via Netsh

OpenSSH Server Firewall Configuration on Windows - Firewall (via firewall-as)

Suspicious Firewall Rule Added Using PowerShell or CMD (via firewall-as)

Suspicious Firewall Rule Masquerading as CloudExperienceHost via netsh

Suspicious Firewall Rule Masquerading As Windows Update (via process_creation)

Linux firewall rule deletion via iptables, firewall-cmd, ufw, or nft

Pivot detection · T1686 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-firewall-rule-deletions-via-iptables-firewall-cmd-ufw-or-nft-323ff3f5

title: Linux firewall rule deletion via iptables, firewall-cmd, ufw, or nft
id: 2735cfca-9b4d-4fac-b145-2502541f5996
related:
  - id: 53059bc0-1472-438b-956a-7508a94a91f0
    type: similar
  - id: 323ff3f5-0013-4847-bbd4-250b5edb62cc
    type: derived
status: test
description: This rule identifies Linux processes attempting to delete or remove system firewall rules by matching execve activity for iptables DROP operations, firewall-cmd remove commands, ufw delete commands, and nft delete/flush commands. Removing firewall rules can weaken network access controls and enable evasion or unauthorized communication. It relies on auditd telemetry capturing process execution details (process name and command arguments) for these firewall management tools.
references:
  - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
  - https://blog.aquasec.com/container-security-tnt-container-attack
  - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml
author: IAI, Huntrule Team
date: 2023-03-06
modified: 2025-10-12
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  service: auditd
detection:
  selection1:
    type: EXECVE
    a0: iptables
    a1|contains: DROP
  selection2:
    type: EXECVE
    a0: firewall-cmd
    a1|contains: remove
  selection3:
    type: EXECVE
    a0: ufw
    a1|contains: delete
  selection4:
    type: EXECVE
    a0: nft
    a1|contains:
      - delete
      - flush
  condition: 1 of selection*
falsepositives:
  - Legitimate admin activity
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL