Linux: iptables/ufw chain flush commands enabling all network traffic

Flags Linux iptables/ufw activity that flushes firewall rules and can allow broad network traffic.

FreeUnreviewedSigmamediumv1

linux-iptables-ufw-chain-flush-commands-enabling-all-network-traffic-3be619f4

title: "Linux: iptables/ufw chain flush commands enabling all network traffic"
id: 91bf5405-8655-48df-9416-42306aaf7922
status: test
description: This rule identifies Linux process executions where iptables tooling is invoked to flush and delete firewall rules, chains, and related tables (via -F, -Z, and -X). It also matches command lines containing ufw logging allow/deny entries, which can indicate attempts to reduce visibility while changing firewall behavior. The detection relies on process creation telemetry, specifically the executable path ending with iptables/ip6tables variants and the command line parameters and ufw-related strings.
references:
  - https://blogs.blackberry.com/
  - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-18
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - /iptables
      - /xtables-legacy-multi
      - /iptables-legacy-multi
      - /ip6tables
      - /ip6tables-legacy-multi
  selection_params:
    CommandLine|contains:
      - -F
      - -Z
      - -X
  selection_ufw:
    CommandLine|contains:
      - ufw-logging-deny
      - ufw-logging-allow
      - ufw6-logging-deny
      - ufw6-logging-allow
  condition: all of selection_*
falsepositives:
  - Network administrators
level: medium
license: DRL-1.1
related:
  - id: 3be619f4-d9ec-4ea8-a173-18fdd01996ab
    type: derived

What it detects

This rule identifies Linux process executions where iptables tooling is invoked to flush and delete firewall rules, chains, and related tables (via -F, -Z, and -X). It also matches command lines containing ufw logging allow/deny entries, which can indicate attempts to reduce visibility while changing firewall behavior. The detection relies on process creation telemetry, specifically the executable path ending with iptables/ip6tables variants and the command line parameters and ufw-related strings.

Known false positives

Network administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.