Flush Iptables Ufw Chain — Sigma Rule

Rule metadata and linked tags

Author: Joseliyo Sanchez, @Joseliyo_Jstnk. Source status: test; severity: medium. Source dates: 2023-01-18 / not supplied.

{
  "product": "linux",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 99942eebb213d8b703ff7383d81a4ca1158fa6b785ed3048b8be7dd49af8f1f9

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Flush Iptables Ufw Chain
id: 3be619f4-d9ec-4ea8-a173-18fdd01996ab
status: test
description: Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
references:
    - https://blogs.blackberry.com/
    - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-01-18
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '/iptables'
            - '/xtables-legacy-multi'
            - '/iptables-legacy-multi'
            - '/ip6tables'
            - '/ip6tables-legacy-multi'
    selection_params:
        CommandLine|contains:
            - '-F'
            - '-Z'
            - '-X'
    selection_ufw:
        CommandLine|contains:
            - 'ufw-logging-deny'
            - 'ufw-logging-allow'
            - 'ufw6-logging-deny'
            - 'ufw6-logging-allow'
            # - 'ufw-reject-output'
            # - 'ufw-track-inputt'
    condition: all of selection_*
falsepositives:
    - Network administrators
level: medium

Original YAML and metadata in JSON

False positives

• Network administrators

Source references

• https://blogs.blackberry.com/
• https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
• https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144