Analytics BIOC
Low
✕
Linux system firewall was modified
The system firewall was modified.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)
Attacker's goals:
Exfiltrate data or move laterally in the organization.
Investigative actions:
Examine the command to understand which IPs or ports were affected. Check the communication allowed by the modified firewall rule.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day