System Information Discovery - Auditd

{
  "selection_1": {
    "type": "PATH",
    "name": [
      "/etc/lsb-release",
      "/etc/redhat-release",
      "/etc/issue"
    ]
  },
  "selection_2": {
    "type": "EXECVE",
    "a0": [
      "uname",
      "uptime",
      "lsmod",
      "hostname",
      "env"
    ]
  },
  "selection_3": {
    "type": "EXECVE",
    "a0": "grep",
    "a1
| contains": [
      "vbox",
      "vm",
      "xen",
      "virtio",
      "hv"
    ]
  },
  "selection_4": {
    "type": "EXECVE",
    "a0": "kmod",
    "a1": "list"
  },
  "condition": "1 of selection_*"
}

False Positives

• ⚠ Likely