Detection rules › Sigma
Firewall Disabled
Detects disabling of the macOS firewall which exposes the system to network attacks
Known false positives
- Network troubleshooting
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Rule body
title: Firewall Disabled
id: 29e86bb3-3940-42e7-8da9-0ea4d47f20df
status: experimental
description: Detects disabling of the macOS firewall which exposes the system to network
attacks
references:
- https://attack.mitre.org/techniques/T1562/004/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.defense_evasion
- attack.t1562.004
logsource:
product: macos
service: unifiedlog
category: firewall_events
detection:
selection:
subsystem: com.apple.alf
message|contains:
- firewall disabled
- firewall stopped
- global state disabled
condition: selection
falsepositives:
- Network troubleshooting
level: high
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
subsystem: com.apple.alf
message|contains:
- firewall disabled
- firewall stopped
- global state disabled
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
message | match |
| field:"message" kind:match |
subsystem | eq |
| field:"subsystem" kind:eq value:"com.apple.alf" |