Analytics BIOC Low
✕

The Linux system firewall was disabled

The system firewall was disabled.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)
Attacker's goals:

Exfiltrate data or move laterally in the organization.

Investigative actions:

Examine the command to understand which ip or port were affected. Check the communication allowed by the created firewall rule.

Test period:
N/A (single event)
Deduplication:
10 Minutes