11
GitHub - bfuzzy/auditd-attack: A Linux Auditd rule set mapped to MITRE's...
source link: https://github.com/bfuzzy/auditd-attack
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
README.md
auditd-attack
A Linux Auditd rule set mapped to MITRE's Attack Framework
Disclaimer
Please ensure you test these rules prior to pushing them into production. Also, events related to sudo and file creation / deletion types of events...etc can be fairly noisy during day-to-day operations and I reccomend you disable them if you're not prepared to handle a large corpus of events, but are needed for detection / hunting purposes.
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK