CmdID

CmdID / Commands

iptables

Configure tables, chains, and rules of the Linux kernel IPv4 firewall. tldr-pages

On Linux 3 Sigma rules name it

Linux

from tldr-pages, CC BY 4.0

Configure tables, chains, and rules of the Linux kernel IPv4 firewall. Use ip6tables to set rules for IPv6 traffic.

View chains, rules, packet/byte counters, and line numbers for the filter table

sudo iptables --verbose --numeric --list --line-numbersIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Set chain policy rule

sudo iptables --policy chain ruleIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Append rule to chain policy for IP

sudo iptables --append chain --source ip_address --jump ruleIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Append rule to chain policy for IP considering protocol and port

sudo iptables --append chain --source ip_address --protocol tcp --dport port --jump ruleIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Add a NAT rule to translate all traffic from the 192.168.0.0/24 subnet to the host's public IP

sudo iptables --table nat --append POSTROUTING --source 192.168.0.0/24 --jump MASQUERADEIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Delete chain rule

sudo iptables --delete chain rule_line_numberIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

What detects it

Sigma process creation rules that name iptables

highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumFlush Iptables Ufw ChainJoseliyo Sanchez, @Joseliyo_Jstnk

informationalSystem Network Discovery - LinuxÖmer Günal and remotephone, oscd.community