Suspicious manipulation of firewall detected via Syslog data

This query searches for any suspicious manipulation of firewall often performed by attackers after exploiting remote code execution vulnerability in Log4j component of Apache for C2 communications or exfiltration.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: syslog
Log source service: syslog

Detection rules

Suspicious manipulation of firewall detected via Syslog data

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules