Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
32
12
2
1
1
Contributors
20
7
7
4
3
Categories
36
35
28
6
5
Platforms
33
17
2
1
Products / Services
26
11
8
8
7
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.
Detection rules that match only on the disabling of firewalls will miss this.
Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
Detects disabling security tools
Detects disabling security tools
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Page 3 of 3