Suspicious UFW Disable Attempt (via process_creation)

title: Suspicious UFW Disable Attempt (via process_creation)
id: 598a3c14-635f-55f1-afb1-3e7ef8faee60
status: stable
description: This rule detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may enable unauthorized access to network services and resources.
references:
    - https://attack.mitre.org/techniques/T1686/
    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
    - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html
    - https://www.cyberciti.biz/faq/linux-disable-firewall-command/
author: Huntrule Team
date: 2026-04-15
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    category: process_creation
detection:
    selection_ufw_init:
        Image|endswith: '/ufw-init'
        CommandLine|contains:
            - ' force-stop'
            - ' stop'
            - ' flush'
    selection_ufw_disable:
        CommandLine|contains|all:
            - 'ufw '
            - 'disable'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium