huntrule

Linux iptables/ufw Firewall Rule Flush via Process Execution

Flags Linux iptables/ufw activity that flushes firewall rules and can allow broad network traffic.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published
2023-01-18
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Linux processes executing iptables (including legacy and IPv4/IPv6 variants) with command-line options to flush and delete firewall rules and chains. It also looks for ufw-related command-line strings associated with logging allow/deny behavior. Such actions can impair defensive controls by removing or weakening filtering, so attackers may use them during evasion or disruption. The detection relies on Linux process creation telemetry that includes the executable path and full command line.

Reporting behind it

Related detections9 linkedT1686 — drag to rearrange
Suspicious Windows Firewall Rule Creation Masquerading as Network Discovery (via process_creation)
Suspicious Firewall Flush via iptables in Kinsing Intrusion
Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware
Suspicious iptables Port Redirect Rule via GRIMBOLT
Suspicious Firewall Allow Rule for TightVNC Server via netsh (via process_creation)
Suspicious Firewall Rule Added to Open RDP Port 3389 via netsh
Suspicious VMware PCI Device Disabled via Devcon
Possible Firewall Rule Manipulation via netsh advfirewall by FishMonger
Suspicious netsh Firewall Rule Masquerading as SSTP HTTP
Linux iptables/ufw Firewall Rule Flush via Process Execution
Pivot detection · T1686 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.