UFW Disable Attempt — Sigma Rule

Rule metadata and linked tags

Author: Joseliyo Sanchez, @Joseliyo_Jstnk. Source status: test; severity: medium. Source dates: 2023-01-18 / 2026-05-04.

{
  "product": "linux",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 66dfe995bfa6b4bf86f75bcca3080dccc213a0e1271ff157cb2fb60e41837e6a

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: UFW Disable Attempt
id: 84c9e83c-599a-458a-a0cb-0ecce44e807a
status: test
description: |
    Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
    UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
    Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
references:
    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
    - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html
    - https://www.cyberciti.biz/faq/linux-disable-firewall-command/
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-01-18
modified: 2026-05-04
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    category: process_creation
detection:
    selection_ufw_init:
        Image|endswith: '/ufw-init'
        CommandLine|contains:
            - ' force-stop' # same as stop, except does not check if the firewall is already loaded
            - ' stop' # unloads the firewall
            - ' flush' # flushes the built-in chains, deletes all non-built-in chains and resets the policy to ACCEPT
    selection_ufw_disable:
        CommandLine|contains|all:
            # Covers both ufw disable and systemctl disable ufw
            # systemctl disable ufw -- prevents UFW starting at boot, but does not stop the currently running instance of UFW
            # ufw disable -- stops the currently running instance of UFW and prevents it from starting at boot
            - 'ufw '
            - 'disable'
    condition: 1 of selection_*
falsepositives:
    - Legitimate actions by system administrators to disable UFW.
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate actions by system administrators to disable UFW.

Source references

• https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
• https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html
• https://www.cyberciti.biz/faq/linux-disable-firewall-command/