This rule detects Linux firewall rule creation or modification operations that add DROP, ACCEPT, or REJECT rules. It triggers on process start events for firewall tools (iptables, ip6tables, nft, ufw, etc.) when the command-line arguments include insert/append/replace actions and references to DROP/ACCEPT/REJECT. By capturing the process name, arguments, user, and provenance, it aims to identify attempts to weaken network controls, block monitoring, or enable unauthorized access. The rule is aligned with MITRE ATT&CK T1562.004 (Disable or Modify System Firewall) under Defense Evasion and supports detection of both direct firewall commands and newer nft/xtables invocations. It integrates signals from multiple EDR/data sources (Elastic Defend, Auditd Manager, CrowdStrike, SentinelOne, Auditbeat) and is designed to be correlated with authentication events, privilege escalation, and configuration-management activity to determine legitimacy and guide response.