mjhjmtu

We use Auditd to monitor specific changes on Linux systems. Majority of our rules come from CIS Benchmark guidelines and then few are added specifically to monitor certain command executions.

We have only seen the following record types so far:

PATH, SYSCALL, CWD, AVC, EXECVE, USER_CMD, USER_LOGIN, USER_AUTH

As per the this link, there are several interesting types which would be crucial to monitor. Few which seem important in our environment are

KERNEL, ADD_USER, ADD_GROUP, MAC_STATUS, NETFILTER_CFG.

Based on the rules mentioned below, can anyone assist in figuring out if these events are being monitored and just haven't been triggered yet, or is the current ruleset incomplete?

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change 
-a always,exit -F arch=b64 -S clock_settime -k time-change 
-w /etc/localtime -p wa -k time-change 
-w /etc/group -p wa -k identity 
-w /etc/passwd -p wa -k identity 
-w /etc/gshadow -p wa -k identity 
-w /etc/shadow -p wa -k identity 
-w /etc/security/opasswd -p wa -k identity 
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale 
-w /etc/issue.net -p wa -k system-locale 
-w /etc/hosts -p wa -k system-locale 
-w /etc/sysconfig/network -p wa -k system-locale 
-w /etc/selinux/ -p wa -k MAC-policy 
-w /var/log/faillog -p wa -k logins 
-w /var/log/lastlog -p wa -k logins 
-w /var/log/tallylog -p wa -k logins 
-w /var/log/btmp -p wa -k session 
-w /var/run/utmp -p wa -k session 
-w /var/log/wtmp -p wa -k session 
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod 
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod 
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod 
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access 
-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access 
-a always,exit -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295 -k mounts 
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete 
-w /etc/sudoers -p wa -k scope 
-w /var/log/sudo.log -p wa -k actions 
-w /sbin/insmod -p x -k modules 
-w /sbin/rmmod -p x -k modules 
-w /sbin/modprobe -p x -k modules 
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules 
-a always,exit -F path=/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged 
-a always,exit -F path=/bin/ping6 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged 
-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged 
-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged 
-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged 

Few command specific rules:

-a exit,always -F arch=b64 -S execve -F path=/bin/rm 
-a exit,always -F arch=b64 -S execve -F path=/bin/chmod 
-a exit,always -F arch=b64 -S execve -F path=/bin/chgrp 
-a exit,always -F arch=b64 -S execve -F path=/bin/chown 

Data we are currently getting from above rules is extremely helpful and valuable. How to take audit logging a step further?