Suspicious Modify System Firewall (via auditd)

title: Suspicious Modify System Firewall (via auditd)
id: 10e574f9-2930-5f40-95a8-1858b1a0efae
status: stable
description: This rule detects the removal of system firewall rules. Threat actors may only delete or modify a specific system firewall rule to bypass controls limiting network use or access. Detection rules that match only on the disabling of firewalls will miss this.
references:
    - https://attack.mitre.org/techniques/T1686/
    - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
    - https://blog.aquasec.com/container-security-tnt-container-attack
    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
author: Huntrule Team
date: 2026-02-24
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    service: auditd
detection:
    selection1:
        type: 'EXECVE'
        a0: 'iptables'
        a1|contains: 'DROP'
    selection2:
        type: 'EXECVE'
        a0: 'firewall-cmd'
        a1|contains: 'remove'
    selection3:
        type: 'EXECVE'
        a0: 'ufw'
        a1|contains: 'delete'
    selection4:
        type: 'EXECVE'
        a0: 'nft'
        a1|contains:
            - 'delete'
            - 'flush'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: medium