sigmamediumHunting

Ufw Force Stop Using Ufw-Init

Detects attempts to force stop the ufw using ufw-init

MITRE ATT&CK

defense-evasion

Detection Query

selection_init:
  CommandLine|contains|all:
    - -ufw-init
    - force-stop
selection_ufw:
  CommandLine|contains|all:
    - ufw
    - disable
condition: 1 of selection_*

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Created

2023-01-18

Data Sources

linuxProcess Creation Events

Platforms

linux

References

Tags

attack.defense-evasionattack.t1562.004

Raw Content

title: Ufw Force Stop Using Ufw-Init
id: 84c9e83c-599a-458a-a0cb-0ecce44e807a
status: test
description: Detects attempts to force stop the ufw using ufw-init
references:
    - https://blogs.blackberry.com/
    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-01-18
tags:
    - attack.defense-evasion
    - attack.t1562.004
logsource:
    product: linux
    category: process_creation
detection:
    selection_init:
        CommandLine|contains|all:
            - '-ufw-init'
            - 'force-stop'
    selection_ufw:
        CommandLine|contains|all:
            - 'ufw'
            - 'disable'
    condition: 1 of selection_*
falsepositives:
    - Network administrators
level: medium