UFW Disable Attempt

Title: UFW Disable Attempt
Status: test
Description:Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
References:
  -https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  -https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html
  -https://www.cyberciti.biz/faq/linux-disable-firewall-command/
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-18
modified:2026-05-04
Tags:

• -'attack.defense-impairment'
• -'attack.t1686'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection_ufw_init:
    Image|endswith: '/ufw-init'
    CommandLine|contains:
      -' force-stop'
      -' stop'
      -' flush'

  selection_ufw_disable:
    CommandLine|contains|all:
      -'ufw '
      -'disable'

  condition:1 of selection_*
Falsepositives:
  -Legitimate actions by system administrators to disable UFW.
Level: medium