Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
33
12
2
1
1
Contributors
20
7
7
4
3
Categories
37
36
29
6
6
Platforms
34
18
2
1
1
Products / Services
26
11
8
8
8
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
UFW Disable Attempt
Sigma
Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.
Detection rules that match only on the disabling of firewalls will miss this.
Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
Detects disabling security tools
Detects disabling security tools
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Page 3 of 3