<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: configuring-auditd-rules
description: >-
  Configure Linux auditd for system call auditing, file integrity monitoring,
  and security event detection. Covers rule syntax, key audit rules for
  threat detection, performance tuning, and SIEM integration.
domain: cybersecurity
subdomain: blue-team
tags:
  - auditd
  - linux
  - syscall-auditing
  - file-integrity
  - detection-engineering
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.001"]
---

# Configuring Auditd Rules

## Overview

The Linux Audit Framework (auditd) monitors system calls, file access, and
authentication events at the kernel level. It is the primary telemetry source
for Linux threat detection, compliance auditing, and forensic investigation.

## Prerequisites

| Requirement | Purpose |
|---|---|
| auditd package | `apt install auditd` or `yum install audit` |
| Root access | Rule configuration requires root |
| ausearch / aureport | Log analysis tools (included with auditd) |
| SIEM forwarder | Ship audit logs to central platform |

## Key Concepts

### Rule Types

| Type | Syntax | Purpose |
|---|---|---|
| File watch | `-w /path -p rwxa -k keyname` | Monitor file/directory access |
| Syscall | `-a always,exit -F arch=b64 -S syscall -k key` | Monitor system calls |
| Control | `-b 8192` | Buffer size, rate limiting |

### Essential Security Rules

```bash
# /etc/audit/rules.d/99-security.rules

# === Identity and Authentication ===
# Monitor user/group changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d/ -p wa -k identity

# === Persistence Mechanisms ===
# Cron job modifications
-w /etc/crontab -p wa -k cron_changes
-w /etc/cron.d/ -p wa -k cron_changes
-w /etc/cron.daily/ -p wa -k cron_changes
-w /var/spool/cron/ -p wa -k cron_changes

# Systemd service creation
-w /etc/systemd/system/ -p wa -k systemd_changes
-w /usr/lib/systemd/system/ -p wa -k systemd_changes

# SSH configuration
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /root/.ssh/ -p wa -k ssh_keys

# === Privilege Escalation ===
# Setuid/setgid calls
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k priv_esc
# Sudo usage
-w /var/log/sudo.log -p wa -k sudo_log
-w /usr/bin/sudo -p x -k sudo_exec

# === Process Execution ===
# Monitor execve for process creation
-a always,exit -F arch=b64 -S execve -k exec_log

# === Network ===
# Monitor socket creation (connect/accept)
-a always,exit -F arch=b64 -S connect -S accept -S bind -k network

# === Anti-Forensics ===
# Log deletion / tampering
-w /var/log/ -p wa -k log_tampering
-w /var/log/audit/ -p wa -k audit_tampering

# File deletion
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -k file_delete

# === Kernel Modules ===
-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k kernel_modules

# === Make rules immutable (must be last) ===
-e 2
```

### Rule Operations

```bash
# Load rules from file
augenrules --load

# List active rules
auditctl -l

# Check rule status
auditctl -s

# Add temporary rule (lost on restart)
auditctl -w /tmp -p wa -k tmp_watch

# Delete all rules (temporary)
auditctl -D
```

### Searching Audit Logs

```bash
# Search by key
ausearch -k identity --start today -i

# Search by event type
ausearch -m EXECVE --start today -i

# Search by user
ausearch -ua 1000 --start today -i

# Search for specific file access
ausearch -f /etc/shadow --start today -i

# Failed syscalls (potential exploit attempts)
ausearch --success no --start today -i

# Generate summary reports
aureport --summary
aureport --auth --summary
aureport --login --summary
aureport --file --summary
aureport --executable --summary
```

### Performance Tuning

```bash
# /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log
log_format = ENRICHED
max_log_file = 50
max_log_file_action = ROTATE
num_logs = 10
space_left = 150
space_left_action = email
admin_space_left_action = halt
flush = INCREMENTAL_ASYNC
freq = 50

# Buffer size for high-volume systems
# /etc/audit/rules.d/00-buffer.rules
-b 8192
-r 0
--backlog_wait_time 60000
```

## Workflow

1. **Install** — `apt install auditd audispd-plugins`
2. **Configure** — Write rules to `/etc/audit/rules.d/99-security.rules`
3. **Load** — `augenrules --load`
4. **Verify** — `auditctl -l` shows all rules active
5. **Test** — Trigger a rule (e.g., `cat /etc/shadow`), verify with `ausearch -k identity`
6. **Forward** — Configure syslog or audisp plugin to ship to SIEM
7. **Monitor** — Regular `aureport` reviews for anomalies

## Detection

```yaml
title: Auditd Rules Detection
id: 168f28a8-8fcf-4507-a61e-926c73a80598
status: experimental
description: Detects suspicious activity related to configuring auditd rules techniques in blue team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*configuring*auditd*"
  condition: selection
level: medium
tags:
  - attack.t1562.001
  - attack.defense_evasion
falsepositives:
  - Security team running authorized detection validation tools
```

## Verification

| Check | Method |
|---|---|
| auditd running | `systemctl status auditd` — active |
| Rules loaded | `auditctl -l` — rules present |
| Events generating | `ausearch -k identity --start today` returns results |
| Buffer adequate | `auditctl -s` — lost=0 |
| Logs rotating | `ls -la /var/log/audit/` — multiple log files |
| Immutable flag | `auditctl -s` — enabled=2 (after reboot) |

## References

- [Red Hat Audit Documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/auditing-the-system_security-hardening)
- [Linux Audit Repo (Neo23x0)](https://github.com/Neo23x0/auditd)
- [CIS Benchmark Section 4.1](https://www.cisecurity.org/benchmark/ubuntu_linux)
