Suspicious Flush Iptables Ufw Chain (via process_creation)

title: Suspicious Flush Iptables Ufw Chain (via process_creation)
id: e64226b0-9f33-57fb-8cb3-d4b74cf596bc
status: stable
description: This rule detects use of iptables to flush all firewall rules, tables and chains and enable all network traffic
references:
    - https://attack.mitre.org/techniques/T1686/
    - https://blogs.blackberry.com/
    - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
author: Huntrule Team
date: 2026-01-05
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '/iptables'
            - '/xtables-legacy-multi'
            - '/iptables-legacy-multi'
            - '/ip6tables'
            - '/ip6tables-legacy-multi'
    selection_params:
        CommandLine|contains:
            - '-F'
            - '-Z'
            - '-X'
    selection_ufw:
        CommandLine|contains:
            - 'ufw-logging-deny'
            - 'ufw-logging-allow'
            - 'ufw6-logging-deny'
            - 'ufw6-logging-allow'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium