lambsys Firewall Disablement via iptables, ufw, firewalld, or nft flush

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•4

Detects attempts to disable or flush system firewall rules on Linux platforms using common tools like iptables, ufw, firewalld, and nftables. Adversaries often perform these actions to bypass network controls and facilitate unauthorized communication.