UFW Disable Attempt

detection:
  selection_ufw_disable:
    CommandLine|contains|all:
      - 'ufw '
      - 'disable'
  selection_ufw_init:
    CommandLine|contains:
      - ' force-stop'
      - ' stop'
      - ' flush'
    Image|endswith: '/ufw-init'
  condition: 1 of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Joseliyo Sanchez, @Joseliyo_Jstnk, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.