Linux-Auditd Event ID 1309

Sigma (28)

• ASLR Disabled Via Sysctl or Direct Syscall - Linux severity high T1055, T1055.009, T1685
• Audio Capture severity low T1123
• Binary Padding - Linux severity high T1027, T1027.001
• Bpfdoor TCP Ports Redirect severity medium T1686
• Clipboard Collection of Image Data with Xclip Tool severity low T1115
• Clipboard Collection with Xclip Tool - Auditd severity low T1115
• Credentials In Files - Linux severity high T1552, T1552.001
• Data Exfiltration with Wget severity medium T1048, T1048.003
• File or Folder Permissions Change severity low T1222, T1222.002
• File Time Attribute Change - Linux severity medium T1070, T1070.006
• Hidden Files and Directories severity low T1564, T1564.001
• Linux Capabilities Discovery severity low T1083, T1548
• Modify System Firewall severity medium T1686
• Overwriting the File with Dev Zero or Null severity low T1485
• Password Policy Discovery - Linux severity low T1201
• Remove Immutable File Attribute - Auditd severity medium T1222, T1222.002
• Screen Capture with Import Tool severity low T1113
• Screen Capture with Xwd severity low T1113
• Service Reload or Start - Linux severity low T1543, T1543.002
• Steganography Extract Files with Steghide severity low T1027, T1027.003
• Steganography Hide Files with Steghide severity low T1027, T1027.003
• Steganography Hide Zip Information in Picture File severity low T1027, T1027.003
• Steganography Unzip Hidden Information From Picture File severity low T1027, T1027.003
• Suspicious Commands Linux severity medium T1059, T1059.004
• Suspicious History File Operations - Linux severity medium T1552, T1552.003
• System Information Discovery - Auditd severity low T1082
• System Owner or User Discovery - Linux severity low T1033
• System Shutdown/Reboot - Linux severity informational T1529