Sigma rule: UFW Disable Attempt

Rule

Title

UFW Disable Attempt

Status

test

Level

medium

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Date

2023-01-18

Modified

2026-05-04

File

rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.

Log source

product

linux

category

process_creation

Detection

selection_ufw_init:
    Image|endswith: '/ufw-init'
    CommandLine|contains:
        - ' force-stop' # same as stop, except does not check if the firewall is already loaded
        - ' stop' # unloads the firewall
        - ' flush' # flushes the built-in chains, deletes all non-built-in chains and resets the policy to ACCEPT
selection_ufw_disable:
    CommandLine|contains|all:
        # Covers both ufw disable and systemctl disable ufw
        # systemctl disable ufw -- prevents UFW starting at boot, but does not stop the currently running instance of UFW
        # ufw disable -- stops the currently running instance of UFW and prevents it from starting at boot
        - 'ufw '
        - 'disable'
condition: 1 of selection_*

False positives (as the rule lists them)

• Legitimate actions by system administrators to disable UFW.

Tags

• attack.defense-impairment
• attack.t1686

MITRE ATT&CK ids this rule names

• T1686

References

• https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
• https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html
• https://www.cyberciti.biz/faq/linux-disable-firewall-command/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml