{"id":"323ff3f5-0013-4847-bbd4-250b5edb62cc","title":"Modify System Firewall","description":"Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.\nDetection rules that match only on the disabling of firewalls will miss this.\n","author":"IAI","status":"test","level":"medium","date":"2023-03-06","modified":"2025-10-12","tags":["attack.defense-impairment","attack.t1686"],"technique_ids":["T1686"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Legitimate admin activity"],"references":["https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html","https://blog.aquasec.com/container-security-tnt-container-attack","https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking"],"source_path":"rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml","source_sha256":"bf8647b430fe196ca218d613ba4c8279bca9d6e18c1cc1b508bd7b40ccfc0a02","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Modify System Firewall\nid: 323ff3f5-0013-4847-bbd4-250b5edb62cc\nrelated:\n    - id: 53059bc0-1472-438b-956a-7508a94a91f0\n      type: similar\nstatus: test\ndescription: |\n    Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.\n    Detection rules that match only on the disabling of firewalls will miss this.\nreferences:\n    - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html\n    - https://blog.aquasec.com/container-security-tnt-container-attack\n    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking\nauthor: IAI\ndate: 2023-03-06\nmodified: 2025-10-12\ntags:\n    - attack.defense-impairment\n    - attack.t1686\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection1:\n        type: 'EXECVE'\n        a0: 'iptables'\n        a1|contains: 'DROP'\n    selection2:\n        type: 'EXECVE'\n        a0: 'firewall-cmd'\n        a1|contains: 'remove'\n    selection3:\n        type: 'EXECVE'\n        a0: 'ufw'\n        a1|contains: 'delete'\n    selection4:\n        type: 'EXECVE'\n        a0: 'nft'\n        a1|contains:\n            - 'delete'\n            - 'flush'\n    condition: 1 of selection*\nfalsepositives:\n    - Legitimate admin activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","page":"techniques/enterprise/T1686/"}],"data_path":"data/detection-rules/323ff3f5-0013-4847-bbd4-250b5edb62cc.json","kind":"sigma"}