← All cheat sheets

AUDITD

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

The Linux Audit daemon (auditd) records security-relevant kernel events:
file access, syscalls, logins, and command execution. Rules live in
/etc/audit/rules.d/*.rules (compiled by augenrules) or are set live with
auditctl. Logs go to /var/log/audit/audit.log.

SERVICE & STATUS#

systemctl status auditd           service state
auditctl -s                       kernel audit status (enabled, backlog)
auditctl -l                       list currently loaded rules
auditctl -e 1                     enable auditing (0 off, 2 = locked)
augenrules --load                 compile rules.d/*.rules and load
service auditd restart            reload (do NOT stop auditd to edit rules
                                  on systemd -- use augenrules)

RULE TYPES#

1) Control rules  : -D (delete all), -b (backlog), -f (failure mode), -e
2) File watches   : -w <path> -p <perms> -k <key>
3) Syscall rules  : -a <action,filter> -S <syscall> [-F field=val] -k <key>

Permissions for -p:  r (read)  w (write)  x (execute)  a (attribute change)

FILE / DIRECTORY WATCHES (-w)#

-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd
-w /var/log/ -p wa -k log_tamper
-w /etc/crontab -p wa -k cron
-w /etc/cron.d/ -p wa -k cron
-w /root/.ssh/ -p wa -k ssh_keys
-w /sbin/insmod -p x -k modules
-w /bin/su -p x -k priv_esc
-w /usr/bin/sudo -p x -k priv_esc

-k <key> tags events so you can search them later with ausearch -k.

SYSCALL RULES (-a action,filter)#

action: always | never      filter: exit | user | task | exclude
Use "always,exit" for most monitoring.

# Record every command execution (execve) -- powerful, can be noisy
-a always,exit -F arch=b64 -S execve -k exec
-a always,exit -F arch=b32 -S execve -k exec

# Unauthorized file-access attempts (permission denied)
-a always,exit -F arch=b64 -S open,openat -F exit=-EACCES -k access
-a always,exit -F arch=b64 -S open,openat -F exit=-EPERM  -k access

# Changes to system time
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time

# Loading/unloading kernel modules (persistence/rootkit)
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k modules

# Mounting filesystems
-a always,exit -F arch=b64 -S mount -k mounts

# Watch a specific user's actions (by uid)
-a always,exit -F arch=b64 -S execve -F uid=1001 -k watch_user

Common -F fields: arch, uid, euid, auid (login uid), gid, pid, exit,
success, path, dir, perm, key.

SEARCHING EVENTS (ausearch)#

ausearch -k identity                 all events with key "identity"
ausearch -k exec -i                  interpret (resolve uid/syscall names)
ausearch -ua jdoe                    by login user name
ausearch -ui 1001                    by uid
ausearch -p 4321                     by pid
ausearch -f /etc/passwd              events touching a file
ausearch -m USER_LOGIN               by message/record type
ausearch -ts today                   since start of today
ausearch -ts 10:00:00 -te 11:00:00   time range
ausearch -sc execve -i               by syscall name
ausearch -sv no                      only failed (success=no) events

Useful message types (-m): USER_LOGIN, USER_AUTH, USER_CMD, EXECVE,
SYSCALL, PATH, ADD_USER, DEL_USER, ADD_GROUP, CRED_ACQ, USER_START.

SUMMARY REPORTS (aureport)#

aureport                             overall summary
aureport -au                         authentication report
aureport -l                          login report
aureport -f                          file access report
aureport -x --summary                executable summary
aureport -u --summary                user summary
aureport -m                          account modifications
aureport --failed                    all failed events
aureport -ts today -te now           time-bounded

READING A RAW RECORD#

Each action often produces linked records sharing a timestamp:serial id.
  type=SYSCALL ... syscall=execve success=yes exit=0 a0=... uid=0 auid=1001
  type=EXECVE  ... argc=3 a0="bash" a1="-c" a2="id"
  type=PATH    ... name="/bin/bash" ...
Key fields: auid (the ORIGINAL login user, survives su/sudo), uid/euid
(effective), success, exit, key.

PERSISTENCE / PRIV-ESC HUNTING#

- New/changed users:   ausearch -m ADD_USER,USER_MGMT -i
- sudo usage:          ausearch -k sudoers -i  ; aureport -au
- cron tampering:      ausearch -k cron -i
- SSH key drops:       ausearch -k ssh_keys -i
- kernel modules:      ausearch -k modules -i
- credential files:    ausearch -k identity -i

TIP: baseline execve volume before deploying -S execve fleet-wide; it is the
single noisiest rule. Prefer targeted -F uid / path filters.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.