Query: write Sigma for Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool
Matching passage: Sigma rule: Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool. Logsource: linux / process_creation. Rule: title: UFW Disable Attempt id: 84c9e83c-599a-458a-a0cb-0ecce44e807a status: test description: 'Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources. ' references: - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html - https://www.cyberciti.biz/faq/linux-disable-firewall-command/ author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-18 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux category: process_creation detection: selection_ufw_init: Image|endswith: /ufw-init CommandLine|contains: - ' force-stop' - ' stop' - ' flush' selection_ufw_disable: CommandLine|contains|all: - 'ufw ' - disable condition: 1 of selection_* falsepositives: - Legitimate actions by system administrators to disable UFW. level: medium
Near-miss passage: Sigma rule: Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.. Logsource: windows / ps_classic_provider_start. Rule: title: Tamper Windows Defender - PSClassic id: ec19ebab-72dc-40e1-9728-4c0b805d722c related: - id: 14c71865-6cd3-44ae-adaa-1db923fae5f2 type: similar status: test description: Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-06-07 modified: 2024-01-02 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_classic_provider_start detection: selection_set_mppreference: Data|contains: Set-MpPreference selection_options_bool_allow: Data|contains: - -dbaf $true - -dbaf 1 - -dbm $true - -dbm 1 - -dips $true - -dips 1 - -DisableArchiveScanning $true - -DisableArchiveScanning 1 - -DisableBehaviorMonitoring $true - -DisableBehaviorMonitoring 1 - -DisableBlockAtFirstSeen $true - -DisableBlockAtFirstSeen 1 - -DisableCatchupFullScan $true - -DisableCatchupFullScan 1 - -DisableCatchupQuickScan $true - -DisableCatchupQuickScan 1 - -DisableIntrusionPreventionSystem $true - -DisableIntrusionPreventionSystem 1 - -DisableIOAVProtection $true - -DisableIOAVProtection 1 - -DisableRealtimeMonitoring $true - -DisableRealtimeMonitoring 1 - -DisableRemovableDriveScanning $true - -DisableRemovableDriveScanning 1 - -DisableScanningMappedNetworkDrivesForFullScan $true - -DisableScanningMappedNetworkDrivesForFullScan 1 - -DisableScanningNetworkFiles $true - -DisableScanningNetworkFiles 1 - -DisableScriptScanning $true - -DisableScriptScanning 1 - -MAPSReporting $false - -MAPSReporting 0 - -drdsc $true - -drdsc 1 - -drtm $true - -drtm 1 - -dscrptsc $true - -dscrptsc 1 - -dsmndf $true - -dsmndf 1 - -dsnf $true - -dsnf 1 - -dss $true - -dss 1 selection_options_actions_func: Data|contains: - HighThreatDefaultAction Allow - htdefac Allow - LowThreatDefaultAction Allow - ltdefac Allow - ModerateThreatDefaultAction Allow - mtdefac Allow - SevereThreatDefaultAction Allow - stdefac Allow condition: selection_set_mppreference and 1 of selection_options_* falsepositives: - Legitimate PowerShell scripts that disable Windows Defender for troubleshooting purposes. Must be investigated. level: high