GitHub Repo

Data Source: Linux Auditd Path

Date: 2025-02-20

ID: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d

Author: Teoderick Contreras, Splunk

Description

Logs file system access events on a Linux system, including details about file paths, permissions, and associated processes.

Details

Property Value
Source auditd
Sourcetype auditd
Separator type
Name ▲▼ Technique ▲▼ Type ▲▼
Linux Auditd Doas Conf File Creation Sudo and Sudo Caching TTP
Linux Auditd Possible Access Or Modification Of Sshd Config File SSH Authorized Keys Anomaly
Linux Auditd Possible Access To Sudoers File Sudo and Sudo Caching Anomaly
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Cron Hunting
Linux Auditd Preload Hijack Via Preload File Dynamic Linker Hijacking TTP
Linux Auditd Unix Shell Configuration Modification Unix Shell Configuration Modification TTP
Linux Magic SysRq Key Abuse Unix Shell, System Shutdown/Reboot, Service Stop, Endpoint Denial of Service TTP

Supported Apps

Event Fields

+ Fields 
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">type</span>
  
  <span class="pill kill-chain">item</span>
  
  <span class="pill kill-chain">name</span>
  
  <span class="pill kill-chain">inode</span>
  
  <span class="pill kill-chain">dev</span>
  
  <span class="pill kill-chain">mode</span>
  
  <span class="pill kill-chain">ouid</span>
  
  <span class="pill kill-chain">ogid</span>
  
  <span class="pill kill-chain">rdev</span>
  
  <span class="pill kill-chain">nametype</span>
  
  <span class="pill kill-chain">cap_fp</span>
  
  <span class="pill kill-chain">cap_fi</span>
  
  <span class="pill kill-chain">cap_fe</span>
  
  <span class="pill kill-chain">cap_fver</span>
  
  <span class="pill kill-chain">cap_frootid</span>
  
  <span class="pill kill-chain">OUID</span>
  
  <span class="pill kill-chain">OGID</span>
  
</div>

Example Log

1type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"

Source: GitHub | Version: 2