From 51fed4f537c43800fd6671bb4f20d169f4e85dd1 Mon Sep 17 00:00:00 2001
From: David French <56409778+threat-punter@users.noreply.github.com>
Date: Thu, 2 Jul 2020 11:31:19 -0600
Subject: [PATCH] Update
 defense_evasion_attempt_to_disable_iptables_or_firewall.toml (#11)

---
 ...nse_evasion_attempt_to_disable_iptables_or_firewall.toml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml
index 2e237e75c..e587354c5 100644
--- a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml
+++ b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml
@@ -21,7 +21,11 @@ tags = ["Elastic", "Linux"]
 type = "query"
 
 query = '''
-event.action:(executed or process_started) and (process.name:service and process.args:stop or process.name:chkconfig and process.args:off) and process.args:(ip6tables or iptables or firewalld) or process.name:systemctl and process.args:((firewalld or iptables or ip6tables) and (disable or stop or kill))
+event.action:(executed or process_started) and (
+  (process.name:service and process.args:stop) or
+  (process.name:chkconfig and process.args:off) or
+  (process.name:systemctl and process.args:(disable or stop or kill))
+) and process.args:(ip6tables or iptables or firewalld)
 '''