CmdID

CmdID / Commands

firewall-cmd

The firewalld client. tldr-pages

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from tldr-pages, CC BY 4.0

The firewalld client. View and adapt the runtime or permanent firewall configuration state.

View all available firewall zones and rules in their runtime configuration state

firewall-cmd --list-all-zonesIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Permanently move the interface into the block zone, effectively blocking all communication

firewall-cmd --permanent --zone block --change-interface enp1s0Identify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Permanently open the port for a service in the specified zone (like port 443 when in the public zone)

firewall-cmd --permanent --zone public --add-service httpsIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Permanently close the port for a service in the specified zone (like port 80 when in the public zone)

firewall-cmd --permanent --zone public --remove-service httpIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Permanently forward a port for incoming packets in the specified zone (like port 443 to 8443 when entering the public zone)

firewall-cmd --permanent --zone public --add-rich-rule 'rule family "ipv4" forward-port port "443" protocol "udp" to-port "8443"'Identify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Reload firewalld to lose any runtime changes and force the permanent configuration to take effect immediately

firewall-cmd --reloadIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Save the runtime configuration state to the permanent configuration

firewall-cmd --runtime-to-permanentIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Enable panic mode in case of Emergency. All traffic is dropped, any active connection will be terminated

firewall-cmd --panic-onIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

What detects it

Sigma process creation rules that name firewall-cmd
informationalSystem Network Discovery - LinuxÖmer Günal and remotephone, oscd.community