legitimate actions by system administrators to disable ufw.

t1686
linux
sigma

Techniques

t1686

Sample rules

UFW Disable Attempt

source: sigma
technicques:
- t1686

Description

Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.

Detection logic

condition: 1 of selection_*
selection_ufw_disable:
  CommandLine|contains|all:
  - 'ufw '
  - disable
selection_ufw_init:
  CommandLine|contains:
  - ' force-stop'
  - ' stop'
  - ' flush'
  Image|endswith: /ufw-init