Linux auditd: Detect writes to audit configuration files and related paths

title: "Linux auditd: Detect writes to audit configuration files and related paths"
id: c0f4d6db-fdfc-474d-a103-c89b133e9f9b
status: test
description: This rule identifies events where a process touches auditd-related configuration paths, including /etc/audit/*, /etc/libaudit.conf, and /etc/audisp/*. Changes to these files can be used by attackers to impair auditing or alter logging behavior. The detection relies on auditd service telemetry that records file path access for these specific locations.
references:
  - https://github.com/Neo23x0/auditd/blob/master/audit.rules
  - Self Experience
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_auditing_config_change.yml
author: Mikhail Larin, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name:
      - /etc/audit/*
      - /etc/libaudit.conf
      - /etc/audisp/*
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: high
license: DRL-1.1
related:
  - id: 977ef627-4539-4875-adf4-ed8f780c4922
    type: derived