Auditing Configuration Changes on Linux Host

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•33

This rule detects changes to critical Linux auditd configuration files. Adversaries may modify these files to disable or alter auditing, thereby hindering detection of their malicious activities. Monitoring these files for changes can help identify attempts to evade security monitoring.