Auditing Configuration Changes on Linux Host

Title: Auditing Configuration Changes on Linux Host
Status: test
Description:Detect changes in auditd configuration files
References:
  -https://github.com/Neo23x0/auditd/blob/master/audit.rules
  -Self Experience
Author: Mikhail Larin, oscd.community
Date: 2019-10-25
modified:2021-11-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'PATH'
    name:
      -'/etc/audit/*'
      -'/etc/libaudit.conf'
      -'/etc/audisp/*'

  condition:selection
Falsepositives:
  -Legitimate administrative activity
Level: high