Disable System Firewall

Title: Disable System Firewall
Status: test
Description:Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
  -https://firewalld.org/documentation/man-pages/firewall-cmd.html
Author: Pawel Mazur
Date: 2022-01-22
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1686'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'SERVICE_STOP'
    unit:
      -'firewalld'
      -'iptables'
      -'ufw'

  condition:selection
Falsepositives:
  -Admin activity
Level: high