Linux Service Stop: firewalld, iptables, or ufw Firewall Disabled

Detects stopping firewall services (firewalld/iptables/ufw) on Linux via auditd service-stop events.

FreeUnreviewedSigmahighv1

linux-service-stop-firewalld-iptables-or-ufw-firewall-disabled-53059bc0

title: "Linux Service Stop: firewalld, iptables, or ufw Firewall Disabled"
id: a150cac0-a088-4013-9ebb-df787729d0a2
status: test
description: This rule flags Linux auditd events where firewall-related services are stopped, including firewalld, iptables, and ufw. Stopping these services can reduce host network filtering and help an attacker bypass defensive network controls. It relies on auditd service stop telemetry indicating the specific systemd units that were terminated.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
  - https://firewalld.org/documentation/man-pages/firewall-cmd.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/service_stop/lnx_auditd_disable_system_firewall.yml
author: Pawel Mazur, Huntrule Team
date: 2022-01-22
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SERVICE_STOP
    unit:
      - firewalld
      - iptables
      - ufw
  condition: selection
falsepositives:
  - Admin activity
level: high
license: DRL-1.1
related:
  - id: 53059bc0-1472-438b-956a-7508a94a91f0
    type: derived

What it detects

This rule flags Linux auditd events where firewall-related services are stopped, including firewalld, iptables, and ufw. Stopping these services can reduce host network filtering and help an attacker bypass defensive network controls. It relies on auditd service stop telemetry indicating the specific systemd units that were terminated.

Known false positives

Admin activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.