<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-configuration-audit
description: >-
  Systematic assessment of system, network, and application configurations against security hardening baselines including CIS Benchmarks, DISA STIGs, and vendor security guides. Identifies misconfigurations and compliance gaps.
domain: cybersecurity
subdomain: security-testing
tags:
  - configuration-audit
  - cis-benchmarks
  - stig
  - hardening
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078", "T1562", "T1222"]
  tools: ["cis-cat", "oscap", "lynis", "inspec", "ansible", "nessus"]
---

# Conducting Configuration Audit

## Overview

Configuration auditing evaluates system hardening against established baselines to identify security misconfigurations, default credentials, unnecessary services, weak permissions, and compliance gaps that increase attack surface.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `cis-cat` | Security tooling |
| `oscap` | Security tooling |
| `lynis` | Security tooling |
| `inspec` | Security tooling |
| `ansible` | Security tooling |
| `nessus` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Baseline Selection

```bash
# CIS Benchmark identification
cat <<'EOF'
CONFIGURATION BASELINES
========================
Operating Systems:
  - CIS Ubuntu Linux 22.04 LTS Benchmark v2.0.0
  - CIS Windows Server 2022 Benchmark v2.0.0
  - CIS Red Hat Enterprise Linux 9 Benchmark v1.0.0

Network Devices:
  - CIS Cisco IOS Benchmark v4.1.0
  - CIS Palo Alto Firewall Benchmark v1.0.0

Cloud:
  - CIS AWS Foundations Benchmark v2.0.0
  - CIS Azure Foundations Benchmark v2.0.0
  - CIS Google Cloud Platform Benchmark v2.0.0

Applications:
  - CIS Apache HTTP Server Benchmark v2.0.0
  - CIS NGINX Benchmark v2.0.0
  - CIS PostgreSQL Benchmark v1.0.0
EOF
```

### Step 2: Automated Scanning

```bash
# Lynis — Linux system auditing
lynis audit system --quick --logfile lynis.log --report-file lynis_report.dat

# OpenSCAP — SCAP compliance checking
oscap xccdf eval --profile cis --results results.xml \
  --report report.html /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

# InSpec — infrastructure testing
inspec exec cis-ubuntu-22.04-benchmark -t ssh://user@target \
  --reporter json:inspec_results.json html:inspec_report.html

# Nessus compliance scan (via CLI)
nessuscli scan --policy "CIS Compliance" --targets target_list.txt
```

### Step 3: Manual Configuration Checks

```bash
# SSH hardening verification
grep -E "^(PermitRootLogin|PasswordAuthentication|X11Forwarding|MaxAuthTries)" /etc/ssh/sshd_config

# File permissions audit
find / -perm -4000 -type f 2>/dev/null  # SUID files
find / -perm -2000 -type f 2>/dev/null  # SGID files
find /etc -type f -perm /o+w 2>/dev/null # World-writable in /etc

# Service audit
systemctl list-units --type=service --state=running | grep -v systemd
ss -tlnp  # Listening services

# Password policy verification
grep -E "^(PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_WARN_AGE)" /etc/login.defs
cat /etc/security/pwquality.conf 2>/dev/null
```

### Step 4: Compliance Gap Report

```bash
# Generate compliance gap matrix
cat <<'EOF'
COMPLIANCE GAP REPORT
======================
Benchmark: CIS Ubuntu Linux 22.04 LTS v2.0.0

FAIL — 1.1.1.1  Ensure cramfs kernel module is not available
PASS — 1.1.2.1  Ensure /tmp is a separate partition
FAIL — 5.2.1    Ensure permissions on /etc/ssh/sshd_config
PASS — 5.2.4    Ensure SSH PermitRootLogin is disabled
FAIL — 5.4.1    Ensure password expiration is 365 days or less
PASS — 6.1.1    Ensure permissions on /etc/passwd

Summary: 142 passed / 28 failed / 5 not applicable
Compliance Score: 83.5%
EOF
```

## Detection

```yaml
title: Configuration Audit Detection
id: 8fcd6cd4-5814-4326-a14e-c90b6ba3df42
status: experimental
description: Detects suspicious activity related to conducting configuration audit techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*configuration*"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.t1562
  - attack.t1222
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Configuration Audit Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078, T1562, T1222 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
