Nasreddine Bencherchali
5656c48a97
chore: rename auditd folders and others update: Audio Capture - Updated syscall field to SYSCALL in order to make use of enriched logs update: ASLR Disabled Via Sysctl or Direct Syscall - Linux - Updated syscall field to SYSCALL in order to make use of enriched logs update: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall - Updated syscall field to SYSCALL in order to make use of enriched logs update: System Info Discovery via Sysinfo Syscall - Updated syscall field to SYSCALL in order to make use of enriched logs update: Special File Creation via Mknod Syscall - Updated syscall field to SYSCALL in order to make use of enriched logs update: Webshell Remote Command Execution - Updated syscall field to SYSCALL in order to make use of enriched logs
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
title: Modify System Firewall
|
|
id: 323ff3f5-0013-4847-bbd4-250b5edb62cc
|
|
related:
|
|
- id: 53059bc0-1472-438b-956a-7508a94a91f0
|
|
type: similar
|
|
status: test
|
|
description: |
|
|
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
|
|
Detection rules that match only on the disabling of firewalls will miss this.
|
|
references:
|
|
- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
|
|
- https://blog.aquasec.com/container-security-tnt-container-attack
|
|
- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
|
|
author: IAI
|
|
date: 2023-03-06
|
|
modified: 2025-10-12
|
|
tags:
|
|
- attack.t1562.004
|
|
- attack.defense-evasion
|
|
logsource:
|
|
product: linux
|
|
service: auditd
|
|
detection:
|
|
selection1:
|
|
type: 'EXECVE'
|
|
a0: 'iptables'
|
|
a1|contains: 'DROP'
|
|
selection2:
|
|
type: 'EXECVE'
|
|
a0: 'firewall-cmd'
|
|
a1|contains: 'remove'
|
|
selection3:
|
|
type: 'EXECVE'
|
|
a0: 'ufw'
|
|
a1|contains: 'delete'
|
|
selection4:
|
|
type: 'EXECVE'
|
|
a0: 'nft'
|
|
a1|contains:
|
|
- 'delete'
|
|
- 'flush'
|
|
condition: 1 of selection*
|
|
falsepositives:
|
|
- Legitimate admin activity
|
|
level: medium
|