Estul Lachin

All rules

Firewall Or Security Agent Disabled

medium Single event T1685T1686 Defense Impairment

The session flushes iptables, disables ufw or SELinux, or stops firewalld, AppArmor or a cloud provider's security agent (Alibaba Cloud's aegis / aliyun-service), clearing the way for the payload and its outbound connections.

Tested

Matches all 6 attack events in match.jsonl and none of the 5 look-alike events in nomatch.jsonl. See the test events.

False positives

Sigma

title: Firewall Or Security Agent Disabled
id: 73bebb72-8d49-45e8-a00d-e6cf48c45581
status: experimental
description: |
  The session flushes iptables, disables ufw or SELinux, or stops firewalld, AppArmor or a cloud
  provider's security agent (Alibaba Cloud's aegis / aliyun-service), clearing the way for the payload
  and its outbound connections.
references:
  - https://attack.mitre.org/techniques/T1685/
  - https://attack.mitre.org/techniques/T1686/
author: Estul Lachin
date: 2026-11-08
tags:
  - attack.defense-impairment
  - attack.t1685
  - attack.t1686
logsource:
  product: cowrie
detection:
  selection:
    eventid: cowrie.command.input
    input|re: '\biptables\s+(-F|--flush)\b|\bufw\s+disable\b|\bsetenforce\s+0\b|\b(systemctl|service)\s+(stop|disable)\s+(firewalld|apparmor|aegis|aliyun)|\b(systemctl|service)\s+(firewalld|apparmor|aegis|aliyun)\S*\s+stop'
  condition: selection
falsepositives:
  - Administrators troubleshooting firewall rules
level: medium

rules/disable_security_tools.yml

Splunk SPL

``` Firewall Or Security Agent Disabled. Generated from rules/disable_security_tools.yml by tools/build.py; do not edit. ```
index=honeypot sourcetype=cowrie:json eventid="cowrie.command.input"
| regex input="\\biptables\\s+(-F|--flush)\\b|\\bufw\\s+disable\\b|\\bsetenforce\\s+0\\b|\\b(systemctl|service)\\s+(stop|disable)\\s+(firewalld|apparmor|aegis|aliyun)|\\b(systemctl|service)\\s+(firewalld|apparmor|aegis|aliyun)\\S*\\s+stop"

Verified in Splunk against the test events. dist/spl/disable_security_tools.spl

Microsoft Sentinel KQL

// Firewall Or Security Agent Disabled. Generated from rules/disable_security_tools.yml by tools/build.py; do not edit.
Cowrie_CL
| where eventid =~ "cowrie.command.input" and input matches regex "\\biptables\\s+(-F|--flush)\\b|\\bufw\\s+disable\\b|\\bsetenforce\\s+0\\b|\\b(systemctl|service)\\s+(stop|disable)\\s+(firewalld|apparmor|aegis|aliyun)|\\b(systemctl|service)\\s+(firewalld|apparmor|aegis|aliyun)\\S*\\s+stop"

For a custom table Cowrie_CL with Cowrie's field names. Converted, not yet run in Sentinel. dist/kql/disable_security_tools.kql