Detections
Analytics

Revision 1.4

Sep 3, 2020
Functional Update
  • 4.1.10 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/lchown/fchownat
  • 4.1.10 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat
  • 4.1.10 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/lchown/fchownat
  • 4.1.10 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.10 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
  • 4.1.10 Ensure discretionary access control permission modification events are collected - chown/fchown/lchown/fchownat
  • 4.1.10 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EACCES
  • 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EPERM
  • 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - b64 EACCES
  • 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - b64 EPERM
  • 4.1.13 Ensure successful file system mounts are collected - b64 mounts
  • 4.1.13 Ensure successful file system mounts are collected - mounts
  • 4.1.14 Ensure file deletion events by users are collected
  • 4.1.14 Ensure file deletion events by users are collected - b64
  • 4.1.15 Ensure changes to system administration scope (sudoers) is collected - /etc/sudoers
  • 4.1.15 Ensure changes to system administration scope (sudoers) is collected - /etc/sudoers.d
  • 4.1.16 Ensure system administrator actions (sudolog) are collected
  • 4.1.17 Ensure kernel module loading and unloading is collected - /sbin/insmod
  • 4.1.17 Ensure kernel module loading and unloading is collected - /sbin/modprobe
  • 4.1.17 Ensure kernel module loading and unloading is collected - /sbin/rmmod
  • 4.1.17 Ensure kernel module loading and unloading is collected - auditctl b64 init_module
  • 4.1.17 Ensure kernel module loading and unloading is collected - b64 init_module
  • 4.1.17 Ensure kernel module loading and unloading is collected - init_module
  • 4.1.18 Ensure the audit configuration is immutable
  • 4.1.3 Ensure auditing for processes that start prior to auditd is enabled
  • 4.1.4 Ensure events that modify date and time information are collected - adjtimex
  • 4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex
  • 4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex b64
  • 4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime
  • 4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime b64
  • 4.1.4 Ensure events that modify date and time information are collected - auditctl localtime
  • 4.1.4 Ensure events that modify date and time information are collected - clock_settime
  • 4.1.4 Ensure events that modify date and time information are collected - localtime
  • 4.1.4 Ensure events that modify date and time information are collected - stime b32
  • 4.1.5 Ensure events that modify user/group information are collected - /etc/group
  • 4.1.5 Ensure events that modify user/group information are collected - /etc/gshadow
  • 4.1.5 Ensure events that modify user/group information are collected - /etc/passwd
  • 4.1.5 Ensure events that modify user/group information are collected - /etc/security/opasswd
  • 4.1.5 Ensure events that modify user/group information are collected - /etc/shadow
  • 4.1.6 Ensure events that modify the system's network environment are collected - /etc/hosts
  • 4.1.6 Ensure events that modify the system's network environment are collected - /etc/issue
  • 4.1.6 Ensure events that modify the system's network environment are collected - /etc/issue.net
  • 4.1.6 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network
  • 4.1.6 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network-scripts
  • 4.1.6 Ensure events that modify the system's network environment are collected - auditctl b64 sethostname
  • 4.1.6 Ensure events that modify the system's network environment are collected - auditctl sethostname
  • 4.1.6 Ensure events that modify the system's network environment are collected - b64 sethostname
  • 4.1.6 Ensure events that modify the system's network environment are collected - sethostname
  • 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/selinux
  • 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /usr/share/selinux
  • 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/selinux
  • 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /usr/share/selinux
  • 4.1.8 Ensure login and logout events are collected - /var/log/lastlog
  • 4.1.8 Ensure login and logout events are collected - /var/run/faillock
  • 4.1.8 Ensure login and logout events are collected - auditctl /var/log/lastlog
  • 4.1.8 Ensure login and logout events are collected - auditctl /var/run/faillock
  • 4.1.9 Ensure session initiation information is collected - /var/log/btmp
  • 4.1.9 Ensure session initiation information is collected - /var/log/wtmp
  • 4.1.9 Ensure session initiation information is collected - /var/run/utmp
Informational Update
  • 4.1.8 Ensure login and logout events are collected - /var/log/lastlog
  • 4.1.8 Ensure login and logout events are collected - /var/run/faillock
  • 4.1.8 Ensure login and logout events are collected - auditctl /var/log/lastlog
  • 4.1.8 Ensure login and logout events are collected - auditctl /var/run/faillock