Linux iptables/ufw Firewall Rule Flush via Process Execution

Flags Linux iptables/ufw activity that flushes firewall rules and can allow broad network traffic.

FreeReviewedSigma · Medium · v2

Product: linux
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-01-18
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux processes executing iptables (including legacy and IPv4/IPv6 variants) with command-line options to flush and delete firewall rules and chains. It also looks for ufw-related command-line strings associated with logging allow/deny behavior. Such actions can impair defensive controls by removing or weakening filtering, so attackers may use them during evasion or disruption. The detection relies on Linux process creation telemetry that includes the executable path and full command line.

Reporting behind it

Related detections9 linkedT1686 — drag to rearrange

Suspicious Disabling or Flushing of the Linux Host Firewall (via process_creation)

Malicious Firewall Deactivation - PowerShell (via powershell)

Malicious Firewall Deactivation - Firewall (via firewall-as)

Suspicious Outbound Firewall Block Rule Added via Netsh Advfirewall

Malicious Windows Firewall Disable via Netsh

OpenSSH Server Firewall Configuration on Windows - Firewall (via firewall-as)

Suspicious Firewall Rule Added Using PowerShell or CMD (via firewall-as)

Suspicious Firewall Rule Masquerading as CloudExperienceHost via netsh

Suspicious Firewall Rule Masquerading As Windows Update (via process_creation)

Linux iptables/ufw Firewall Rule Flush via Process Execution

Pivot detection · T1686 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-iptables-ufw-chain-flush-commands-enabling-all-network-traffic-3be619f4

title: Linux iptables/ufw Firewall Rule Flush via Process Execution
id: 91bf5405-8655-48df-9416-42306aaf7922
status: test
description: This rule identifies Linux processes executing iptables (including legacy and IPv4/IPv6 variants) with command-line options to flush and delete firewall rules and chains. It also looks for ufw-related command-line strings associated with logging allow/deny behavior. Such actions can impair defensive controls by removing or weakening filtering, so attackers may use them during evasion or disruption. The detection relies on Linux process creation telemetry that includes the executable path and full command line.
references:
  - https://blogs.blackberry.com/
  - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-18
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - /iptables
      - /xtables-legacy-multi
      - /iptables-legacy-multi
      - /ip6tables
      - /ip6tables-legacy-multi
  selection_params:
    CommandLine|contains:
      - -F
      - -Z
      - -X
  selection_ufw:
    CommandLine|contains:
      - ufw-logging-deny
      - ufw-logging-allow
      - ufw6-logging-deny
      - ufw6-logging-allow
  condition: all of selection_*
falsepositives:
  - Network administrators
level: medium
license: DRL-1.1
related:
  - id: 3be619f4-d9ec-4ea8-a173-18fdd01996ab
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL