Techniques
Sample rules
Flush Iptables Ufw Chain
- source: sigma
- technicques:
- t1686
Description
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Detection logic
condition: all of selection_*
selection_img:
Image|endswith:
- /iptables
- /xtables-legacy-multi
- /iptables-legacy-multi
- /ip6tables
- /ip6tables-legacy-multi
selection_params:
CommandLine|contains:
- -F
- -Z
- -X
selection_ufw:
CommandLine|contains:
- ufw-logging-deny
- ufw-logging-allow
- ufw6-logging-deny
- ufw6-logging-allow