Sigma high test sigma

Auditing Configuration Changes on Linux Host

Detect changes in auditd configuration files

View Source

Detection Logic

{
  "selection": {
    "type": "PATH",
    "name": [
      "/etc/audit/*",
      "/etc/libaudit.conf",
      "/etc/audisp/*"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate administrative activity

Field Validations

Loading…

Comments (0)

Loading comments...