Detection rules › Sigma
Modify System Firewall
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment | T1686 Disable or Modify System Firewall |
Event coverage
| Provider | Event |
|---|---|
| Linux-Auditd | Event ID 1309 |
Rule body yaml
title: Modify System Firewall
id: 323ff3f5-0013-4847-bbd4-250b5edb62cc
related:
- id: 53059bc0-1472-438b-956a-7508a94a91f0
type: similar
status: test
description: |
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.
references:
- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
- https://blog.aquasec.com/container-security-tnt-container-attack
- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
author: IAI
date: 2023-03-06
modified: 2025-10-12
tags:
- attack.defense-impairment
- attack.t1686
logsource:
product: linux
service: auditd
detection:
selection1:
type: 'EXECVE'
a0: 'iptables'
a1|contains: 'DROP'
selection2:
type: 'EXECVE'
a0: 'firewall-cmd'
a1|contains: 'remove'
selection3:
type: 'EXECVE'
a0: 'ufw'
a1|contains: 'delete'
selection4:
type: 'EXECVE'
a0: 'nft'
a1|contains:
- 'delete'
- 'flush'
condition: 1 of selection*
falsepositives:
- Legitimate admin activity
level: medium
Stages and Predicates
Stage 0: condition
1 of selection*Stage 1: selection1
selection1:
type: 'EXECVE'
a0: 'iptables'
a1|contains: 'DROP'
Stage 2: selection2
selection2:
type: 'EXECVE'
a0: 'firewall-cmd'
a1|contains: 'remove'
Stage 3: selection3
selection3:
type: 'EXECVE'
a0: 'ufw'
a1|contains: 'delete'
Stage 4: selection4
selection4:
type: 'EXECVE'
a0: 'nft'
a1|contains:
- 'delete'
- 'flush'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.