[Rule tuning] Fix evasion for disable iptables rule (#5)

elastic · Jul 1, 2020 · 46a4008 · 46a4008
1 parent f800050
commit 46a4008
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/04/24"
 ecs_version = ["1.4.0"]
 maturity = "production"
-updated_date = "2020/04/24"
+updated_date = "2020/07/01"
 
 [rule]
 author = ["Elastic"]
@@ -21,7 +21,7 @@ tags = ["Elastic", "Linux"]
 type = "query"
 
 query = '''
-event.action:(executed or process_started) and (process.name:service and process.args:stop or process.name:chkconfig and process.args:off) and process.args:(ip6tables or iptables) or process.name:systemctl and process.args:(firewalld and (disable or stop or kill))
+event.action:(executed or process_started) and (process.name:service and process.args:stop or process.name:chkconfig and process.args:off) and process.args:(ip6tables or iptables or firewalld) or process.name:systemctl and process.args:((firewalld or iptables or ip6tables) and (disable or stop or kill))
 '''