lambsys Firewall Flush: iptables -F, ufw disable, nft flush ruleset

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects attempts to disable or flush system firewall rules on Linux platforms using common utilities like iptables, ufw, or nftables. Adversaries perform these actions to bypass network access controls and facilitate malicious activities such as command and control communications or lateral movement.