Data Source: Linux Auditd Proctitle

Created: 2024-08-08

Last Updated: 2026-10-14

ID: 5a25984a-2789-400a-858b-d75c923e06b1

Author: Teoderick Contreras, Splunk

Description

Logs the full command-line arguments of a process execution on a Linux system, providing visibility into the executed command and its parameters.

Details

Property	Value
Source	`auditd`
Sourcetype	`auditd`
Separator	type

Name ▲▼	Technique ▲▼	Type ▲▼
Linux Auditd Nopasswd Entry In Sudoers File	Sudo and Sudo Caching	Anomaly
Linux Auditd Setuid Using Chmod Utility	Setuid and Setgid	Anomaly
Linux Auditd Sudo Or Su Execution	Sudo and Sudo Caching	Anomaly
Linux Auditd File Permission Modification Via Chmod	Linux and Mac Permissions	Anomaly
Linux Auditd Possible Access To Credential Files	/etc/passwd and /etc/shadow	Anomaly
Linux Auditd Service Started	Service Execution	Anomaly
Linux Auditd Service Restarted	Systemd Timers	Anomaly
Linux Auditd AI CLI Permission Override Activated	Execution Guardrails	Anomaly
Linux Auditd Shred Overwrite Command	Data Destruction	TTP
Linux Auditd Dd File Overwrite	Data Destruction	TTP
Linux Auditd Add User Account	Local Account	Anomaly
Linux Auditd Change File Owner To Root	Linux and Mac Permissions	Anomaly
Linux Auditd Data Destruction Command	Data Destruction	TTP

Supported Apps

Splunk Add-on for Unix and Linux (version 10.3.4)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">ALL</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">if</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">of</span>
  
  <span class="pill kill-chain">proctitle</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">type</span>
  
</div>

Example Log

1type=PROCTITLE msg=audit(02/20/2025 10:42:55.725:93710): proctitle=echo malware_user ALL=(ALL) NOPASSWD: ALL

Source: GitHub | Version: 4