Sigma rule: Modify System Firewall

Rule

Title

Modify System Firewall

Status

test

Level

medium

Author

IAI

Date

2023-03-06

Modified

2025-10-12

File

rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.

Log source

product

linux

service

auditd

Detection

selection1:
    type: 'EXECVE'
    a0: 'iptables'
    a1|contains: 'DROP'
selection2:
    type: 'EXECVE'
    a0: 'firewall-cmd'
    a1|contains: 'remove'
selection3:
    type: 'EXECVE'
    a0: 'ufw'
    a1|contains: 'delete'
selection4:
    type: 'EXECVE'
    a0: 'nft'
    a1|contains:
        - 'delete'
        - 'flush'
condition: 1 of selection*

False positives (as the rule lists them)

• Legitimate admin activity

Tags

• attack.defense-impairment
• attack.t1686

MITRE ATT&CK ids this rule names

• T1686

Related rules

• 53059bc0-1472-438b-956a-7508a94a91f0 (similar)

References

• https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
• https://blog.aquasec.com/container-security-tnt-container-attack
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml