{"id":"3be619f4-d9ec-4ea8-a173-18fdd01996ab","title":"Flush Iptables Ufw Chain","description":"Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-01-18","modified":"","tags":["attack.defense-impairment","attack.t1686"],"technique_ids":["T1686"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Network administrators"],"references":["https://blogs.blackberry.com/","https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html","https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144"],"source_path":"rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml","source_sha256":"99942eebb213d8b703ff7383d81a4ca1158fa6b785ed3048b8be7dd49af8f1f9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Flush Iptables Ufw Chain\nid: 3be619f4-d9ec-4ea8-a173-18fdd01996ab\nstatus: test\ndescription: Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic\nreferences:\n    - https://blogs.blackberry.com/\n    - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html\n    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-18\ntags:\n    - attack.defense-impairment\n    - attack.t1686\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_img:\n        Image|endswith:\n            - '/iptables'\n            - '/xtables-legacy-multi'\n            - '/iptables-legacy-multi'\n            - '/ip6tables'\n            - '/ip6tables-legacy-multi'\n    selection_params:\n        CommandLine|contains:\n            - '-F'\n            - '-Z'\n            - '-X'\n    selection_ufw:\n        CommandLine|contains:\n            - 'ufw-logging-deny'\n            - 'ufw-logging-allow'\n            - 'ufw6-logging-deny'\n            - 'ufw6-logging-allow'\n            # - 'ufw-reject-output'\n            # - 'ufw-track-inputt'\n    condition: all of selection_*\nfalsepositives:\n    - Network administrators\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","page":"techniques/enterprise/T1686/"}],"data_path":"data/detection-rules/3be619f4-d9ec-4ea8-a173-18fdd01996ab.json","kind":"sigma"}