Detectionmediumtest

Ufw Force Stop Using Ufw-Init

Detects attempts to force stop the ufw using ufw-init

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Joseliyo SanchezCreated Wed Jan 1884c9e83c-599a-458a-a0cb-0ecce44e807alinux

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_init:
        CommandLine|contains|all:
            - '-ufw-init'
            - 'force-stop'
    selection_ufw:
        CommandLine|contains|all:
            - 'ufw'
            - 'disable'
    condition: 1 of selection_*

False Positives

Network administrators

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1562.004 · Disable or Modify System Firewall

Rule Metadata

Rule ID

84c9e83c-599a-458a-a0cb-0ecce44e807a

Status

test

Level

medium

Type

Detection

Created

Wed Jan 18

Author

Joseliyo Sanchez

Path

rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml

Raw Tags

attack.defense-evasionattack.t1562.004

View on GitHub