Detection rules › By event

Linux-Auditd

Event	Rules
msgtype 1100	2
msgtype 1101	1
msgtype 1103	1
msgtype 1105	3
msgtype 1106	2
msgtype 1112	1
msgtype 1114	2
msgtype 1123	2
msgtype 1124	1
msgtype 1131	7
msgtype 1200	1
msgtype 1201	1
msgtype 1202	1
msgtype 1300	27
msgtype 1302	20
msgtype 1307	7
msgtype 1309	58
msgtype 1319	1
msgtype 1321	1
msgtype 1327	21

msgtype 1100

2 detection rules reference this event. View event page.

Splunk (2)

msgtype 1101

1 detection rules reference this event. View event page.

Splunk (1)

Linux Enumeration Techniques T1016, T1033, T1049, T1059, T1059.004, T1069

msgtype 1103

1 detection rules reference this event. View event page.

Splunk (1)

Linux Enumeration Techniques T1016, T1033, T1049, T1059, T1059.004, T1069

msgtype 1105

3 detection rules reference this event. View event page.

Splunk (3)

msgtype 1106

2 detection rules reference this event. View event page.

Splunk (2)

msgtype 1112

1 detection rules reference this event. View event page.

Splunk (1)

Multiple Host logons T1078

msgtype 1114

2 detection rules reference this event. View event page.

Sigma (1)

Creation Of An User Account severity medium T1136, T1136.001

Splunk (1)

Linux Auditd Add User Account Type severity low T1136, T1136.001

msgtype 1123

2 detection rules reference this event. View event page.

Splunk (2)

msgtype 1124

1 detection rules reference this event. View event page.

Sigma (1)

Linux Keylogging with Pam.d severity high T1003, T1056, T1056.001

msgtype 1131

7 detection rules reference this event. View event page.

Sigma (1)

Disable System Firewall severity high T1686

Splunk (6)

Linux Auditd Auditd Service Stop severity low T1489
Linux Auditd Disable Or Modify System Firewall severity low T1686
Linux Auditd Osquery Service Stop severity low T1489
Linux Auditd Stop Services T1489
Linux Auditd Sysmon Service Stop severity low T1489
Service Stop Commands T1489, T1685

msgtype 1200

1 detection rules reference this event. View event page.

Splunk (1)

Linux Auditd Auditd Daemon Start severity low T1685, T1685.004

msgtype 1201

1 detection rules reference this event. View event page.

Splunk (1)

Linux Auditd Auditd Daemon Shutdown severity low T1685, T1685.004

msgtype 1202

1 detection rules reference this event. View event page.

Splunk (1)

Linux Auditd Auditd Daemon Abort severity low T1685, T1685.004

msgtype 1300

27 detection rules reference this event. View event page.

Sigma (12)

ASLR Disabled Via Sysctl or Direct Syscall - Linux severity high T1055, T1055.009, T1685
Audio Capture severity low T1123
Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall severity medium T1685, T1685.006
Creation Of An User Account severity medium T1136, T1136.001
Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator severity high T1068
Linux Network Service Scanning - Auditd severity low T1046
Loading of Kernel Module via Insmod severity high T1547, T1547.006
Program Executions in Suspicious Folders severity medium T1584, T1587
Special File Creation via Mknod Syscall severity low T1543, T1543.003
Split A File Into Pieces - Linux severity low T1030
System Info Discovery via Sysinfo Syscall severity low T1057, T1082
Webshell Remote Command Execution severity critical T1505, T1505.003

Splunk (15)

Linux Auditd At Application Execution severity low T1053, T1053.002
Linux Auditd Copy Fail Privilege Escalation severity medium T1068
Linux Auditd Data Transfer Size Limits Via Split Syscall severity low T1030
Linux Auditd Doas Tool Execution severity low T1548, T1548.003
Linux Auditd Edit Cron Table Parameter severity low T1053, T1053.003
Linux Auditd Insert Kernel Module Using Insmod Utility severity low T1547, T1547.006
Linux Auditd Install Kernel Module Using Modprobe Utility severity low T1547, T1547.006
Linux Auditd Kernel Module Enumeration severity low T1014, T1082
Linux Auditd Kernel Module Using Rmmod Utility severity medium T1547, T1547.006
Linux Auditd System Network Configuration Discovery severity low T1016
Linux Auditd Whoami User Discovery severity low T1033
Linux Dirty Frag Kernel Privilege Escalation severity medium T1068, T1548, T1548.001
Linux Suspicious Namespace Creation severity medium T1068
Potential CVE-2021-4034 T1068, T1548, T1548.001
Rare shell script execution T1059, T1059.004

msgtype 1302

20 detection rules reference this event. View event page.

Sigma (12)

Auditing Configuration Changes on Linux Host severity high T1685
BPFDoor Abnormal Process ID or Lock File Accessed severity high T1059, T1106
Linux Keylogging with Pam.d severity high T1003, T1056, T1056.001
Logging Configuration Changes on Linux Host severity high T1685
Modification of ld.so.preload severity high T1574, T1574.006
Password Policy Discovery - Linux severity low T1201
Potential Abuse of Linux Magic System Request Key severity medium T1059, T1059.004, T1489, T1499, T1529
System and Hardware Information Discovery severity informational T1082
System Information Discovery - Auditd severity low T1082
Systemd Service Creation severity medium T1543, T1543.002
Unix Shell Configuration Modification severity medium T1546, T1546.004
Use Of Hidden Paths Or Files severity low T1574, T1574.001

Splunk (8)

Linux Auditd Doas Conf File Creation severity medium T1548, T1548.003
Linux Auditd Possible Access Or Modification Of Sshd Config File severity low T1098, T1098.004
Linux Auditd Possible Access To Sudoers File severity low T1548, T1548.003
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File T1053, T1053.003
Linux Auditd Preload Hijack Via Preload File severity medium T1574, T1574.006
Linux Auditd Unix Shell Configuration Modification severity medium T1546, T1546.004
Linux Magic SysRq Key Abuse severity medium T1059, T1059.004, T1489, T1499, T1529
Potential CVE-2021-4034 T1068, T1548, T1548.001

msgtype 1307

7 detection rules reference this event. View event page.

Splunk (7)

Linux Auditd Doas Conf File Creation severity medium T1548, T1548.003
Linux Auditd Possible Access Or Modification Of Sshd Config File severity low T1098, T1098.004
Linux Auditd Possible Access To Sudoers File severity low T1548, T1548.003
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File T1053, T1053.003
Linux Auditd Preload Hijack Via Preload File severity medium T1574, T1574.006
Linux Auditd Unix Shell Configuration Modification severity medium T1546, T1546.004
Linux Magic SysRq Key Abuse severity medium T1059, T1059.004, T1489, T1499, T1529

msgtype 1309

58 detection rules reference this event. View event page.

Sigma (32)

ASLR Disabled Via Sysctl or Direct Syscall - Linux severity high T1055, T1055.009, T1685
Audio Capture severity low T1123
Binary Padding - Linux severity high T1027, T1027.001
Bpfdoor TCP Ports Redirect severity medium T1686
Clipboard Collection of Image Data with Xclip Tool severity low T1115
Clipboard Collection with Xclip Tool - Auditd severity low T1115
Credentials In Files - Linux severity high T1552, T1552.001
Data Compressed severity low T1560, T1560.001
Data Exfiltration with Wget severity medium T1048, T1048.003
File or Folder Permissions Change severity low T1222, T1222.002
File Time Attribute Change - Linux severity medium T1070, T1070.006
Hidden Files and Directories severity low T1564, T1564.001
Linux Capabilities Discovery severity low T1083, T1548
Masquerading as Linux Crond Process severity medium T1036, T1036.003
Modify System Firewall severity medium T1686
Network Sniffing - Linux severity low T1040
Overwriting the File with Dev Zero or Null severity low T1485
Password Policy Discovery - Linux severity low T1201
Possible Coin Miner CPU Priority Param severity critical T1068
Remove Immutable File Attribute - Auditd severity medium T1222, T1222.002
Screen Capture with Import Tool severity low T1113
Screen Capture with Xwd severity low T1113
Service Reload or Start - Linux severity low T1543, T1543.002
Steganography Extract Files with Steghide severity low T1027, T1027.003
Steganography Hide Files with Steghide severity low T1027, T1027.003
Steganography Hide Zip Information in Picture File severity low T1027, T1027.003
Steganography Unzip Hidden Information From Picture File severity low T1027, T1027.003
Suspicious Commands Linux severity medium T1059, T1059.004
Suspicious History File Operations - Linux severity medium T1552, T1552.003
System Information Discovery - Auditd severity low T1082
System Owner or User Discovery - Linux severity low T1033
System Shutdown/Reboot - Linux severity informational T1529

Splunk (26)

Clear Command History T1070, T1070.003
Clear Linux System Logs T1070, T1070.003, T1070.004, T1685.006
File Execution (Unix) T1059, T1059.004
File Modified for Execution T1059, T1059.004, T1222, T1222.002, T1548, T1548.001
Go Run Execution T1059
Linux Auditd Base64 Decode Files severity low T1140
Linux Auditd Clipboard Data Copy severity low T1115
Linux Auditd Data Transfer Size Limits Via Split severity low T1030
Linux Auditd Database File And Directory Discovery severity low T1083
Linux Auditd File And Directory Discovery severity low T1083
Linux Auditd File Permissions Modification Via Chattr severity low T1222, T1222.002
Linux Auditd Find Credentials From Password Managers severity medium T1555, T1555.005
Linux Auditd Find Credentials From Password Stores severity medium T1555, T1555.005
Linux Auditd Find Ssh Private Keys severity low T1552, T1552.004
Linux Auditd Hardware Addition Swapoff severity low T1200
Linux Auditd Hidden Files And Directories Creation severity low T1083
Linux Auditd Possible Setuid Execve Privesc severity low T1068
Linux Auditd Preload Hijack Library Calls severity medium T1574, T1574.006
Linux Auditd Private Keys and Certificate Enumeration severity low T1552, T1552.004
Linux Auditd Setuid Using Setcap Utility severity medium T1548, T1548.001
Linux Auditd Unload Module Via Modprobe severity medium T1547, T1547.006
Linux Auditd Virtual Disk File And Directory Discovery severity low T1083
Linux Kernel Module Commands T1547, T1547.006
New Linux Service Started_Enabled T1543, T1543.002
NMAP Execution T1018
Rclone Execution T1030, T1048, T1048.003, T1567, T1567.002

msgtype 1319

1 detection rules reference this event. View event page.

Sigma (1)

Linux Keylogging with Pam.d severity high T1003, T1056, T1056.001

msgtype 1321

1 detection rules reference this event. View event page.

Splunk (1)

Potential CVE-2021-4034 T1068, T1548, T1548.001

msgtype 1327

21 detection rules reference this event. View event page.

Splunk (21)

Clear Command History T1070, T1070.003
Clear Linux System Logs T1070, T1070.003, T1070.004, T1685.006
File Execution (Unix) T1059, T1059.004
Go Run Execution T1059
Linux Auditd Add User Account severity low T1136, T1136.001
Linux Auditd AI CLI Permission Override Activated severity low T1480
Linux Auditd Change File Owner To Root severity low T1222, T1222.002
Linux Auditd Data Destruction Command severity medium T1485
Linux Auditd Dd File Overwrite severity medium T1485
Linux Auditd File Permission Modification Via Chmod severity low T1222, T1222.002
Linux Auditd Nopasswd Entry In Sudoers File severity low T1548, T1548.003
Linux Auditd Possible Access To Credential Files severity low T1003, T1003.008
Linux Auditd Service Restarted severity low T1053, T1053.006
Linux Auditd Service Started severity low T1569, T1569.002
Linux Auditd Setuid Using Chmod Utility severity low T1548, T1548.001
Linux Auditd Shred Overwrite Command severity medium T1485
Linux Auditd Sudo Or Su Execution severity low T1548, T1548.003
Linux Kernel Module Commands T1547, T1547.006
New Linux Service Started_Enabled T1543, T1543.002
NMAP Execution T1018
Rclone Execution T1030, T1048, T1048.003, T1567, T1567.002