Firewall Policy Weakening via Iptables

Ethan Andrews@eandrews

•updated Feb 27, 2026•2•0•39

Detects the execution of iptables to set the default policy for a chain (INPUT, OUTPUT, or FORWARD) to ACCEPT. This technique was used by a stager in a campaign delivering the Rekoobe backdoor to weaken the host's firewall posture and ensure C2 communication.