GitHub Repo

Data Source: Linux Auditd Execve

Created: 2024-08-08

Last Updated: 2026-10-14

ID: 9ef6364d-cc67-480e-8448-3306829a6a24

Author: Teoderick Contreras, Splunk

Description

Logs the execution of processes on a Linux system, including details about the executed command, arguments, and the initiating process.

Details

Property Value
Source auditd
Sourcetype auditd
Separator type
Name ▲▼ Technique ▲▼ Type ▲▼
Linux Auditd Private Keys and Certificate Enumeration Private Keys Anomaly
Linux Auditd File Permissions Modification Via Chattr Linux and Mac Permissions Anomaly
Linux Auditd Base64 Decode Files Deobfuscate/Decode Files or Information Anomaly
Linux Auditd Setuid Using Setcap Utility Setuid and Setgid TTP
Linux Auditd Find Ssh Private Keys Private Keys Anomaly
Linux Auditd Virtual Disk File And Directory Discovery File and Directory Discovery Anomaly
Linux Auditd Unload Module Via Modprobe Kernel Modules and Extensions TTP
Linux Auditd Hidden Files And Directories Creation File and Directory Discovery Anomaly
Linux Auditd Preload Hijack Library Calls Dynamic Linker Hijacking TTP
Linux Auditd Find Credentials From Password Managers Password Managers TTP
Linux Auditd File And Directory Discovery File and Directory Discovery Anomaly
Linux Auditd Hardware Addition Swapoff Hardware Additions Anomaly
Linux Auditd Find Credentials From Password Stores Password Managers TTP
Linux Auditd Possible Setuid Execve Privesc Exploitation for Privilege Escalation Anomaly
Linux Auditd Inline PHP Code Execution Command and Scripting Interpreter Anomaly
Linux Auditd Clipboard Data Copy Clipboard Data Anomaly
Linux Auditd Database File And Directory Discovery File and Directory Discovery Anomaly
Linux Auditd Data Transfer Size Limits Via Split Data Transfer Size Limits Anomaly

Supported Apps

Event Fields

+ Fields 
  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">a0</span>
  
  <span class="pill kill-chain">a1</span>
  
  <span class="pill kill-chain">a2</span>
  
  <span class="pill kill-chain">argc</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">execve_command</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">type</span>
  
</div>

Example Log

1type=EXECVE msg=audit(02/20/2025 11:02:58.146:94942): argc=2 a0=touch a1=./.hide_this_data.txt

Source: GitHub | Version: 4