huntrule

Linux auditd alerts for syslog daemon configuration file changes

Alerts when syslog daemon configuration files are changed on a Linux host via auditd PATH events.

FreeUnreviewedSigmahighv1
title: Linux auditd alerts for syslog daemon configuration file changes
id: ff6878e2-9b23-4170-aaf6-adfba03d155b
status: test
description: This rule flags modifications to common Linux syslog daemon configuration files, including /etc/syslog.conf, /etc/rsyslog.conf, and /etc/syslog-ng/syslog-ng.conf. Attackers can tamper with logging configuration to reduce visibility or interfere with forensic evidence, making this activity important to monitor. It relies on auditd telemetry capturing PATH events for writes or updates to these specific files.
references:
  - self experience
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_logging_config_change.yml
author: Mikhail Larin, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name:
      - /etc/syslog.conf
      - /etc/rsyslog.conf
      - /etc/syslog-ng/syslog-ng.conf
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: high
license: DRL-1.1
related:
  - id: c830f15d-6f6e-430f-8074-6f73d6807841
    type: derived

What it detects

This rule flags modifications to common Linux syslog daemon configuration files, including /etc/syslog.conf, /etc/rsyslog.conf, and /etc/syslog-ng/syslog-ng.conf. Attackers can tamper with logging configuration to reduce visibility or interfere with forensic evidence, making this activity important to monitor. It relies on auditd telemetry capturing PATH events for writes or updates to these specific files.

Known false positives

  • Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.