UFW Force Stop or Disable via Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects attempts to force stop the Uncomplicated Firewall (ufw) using the 'ufw-init' script with the 'force-stop' argument, or disabling ufw using the 'ufw disable' command. This activity can indicate an adversary attempting to bypass host-based firewall controls to facilitate network communications for C2, lateral movement, or data exfiltration.