{"id":"84c9e83c-599a-458a-a0cb-0ecce44e807a","title":"UFW Disable Attempt","description":"Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.\nUFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.\nDisabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-01-18","modified":"2026-05-04","tags":["attack.defense-impairment","attack.t1686"],"technique_ids":["T1686"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate actions by system administrators to disable UFW."],"references":["https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144","https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html","https://www.cyberciti.biz/faq/linux-disable-firewall-command/"],"source_path":"rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml","source_sha256":"66dfe995bfa6b4bf86f75bcca3080dccc213a0e1271ff157cb2fb60e41837e6a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: UFW Disable Attempt\nid: 84c9e83c-599a-458a-a0cb-0ecce44e807a\nstatus: test\ndescription: |\n    Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.\n    UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.\n    Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.\nreferences:\n    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\n    - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html\n    - https://www.cyberciti.biz/faq/linux-disable-firewall-command/\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-18\nmodified: 2026-05-04\ntags:\n    - attack.defense-impairment\n    - attack.t1686\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_ufw_init:\n        Image|endswith: '/ufw-init'\n        CommandLine|contains:\n            - ' force-stop' # same as stop, except does not check if the firewall is already loaded\n            - ' stop' # unloads the firewall\n            - ' flush' # flushes the built-in chains, deletes all non-built-in chains and resets the policy to ACCEPT\n    selection_ufw_disable:\n        CommandLine|contains|all:\n            # Covers both ufw disable and systemctl disable ufw\n            # systemctl disable ufw -- prevents UFW starting at boot, but does not stop the currently running instance of UFW\n            # ufw disable -- stops the currently running instance of UFW and prevents it from starting at boot\n            - 'ufw '\n            - 'disable'\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate actions by system administrators to disable UFW.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","page":"techniques/enterprise/T1686/"}],"data_path":"data/detection-rules/84c9e83c-599a-458a-a0cb-0ecce44e807a.json","kind":"sigma"}