Cyber Security: Linux Source
Source Description
The source is the Linux kernel audit subsystem (auditd). Its rules detect suspicious process execution, privilege escalation, persistence through cron, systemd, PAM, SSH keys, and kernel modules, evidence removal, reconnaissance, and credential access.
The rules analyze system calls and file changes monitored by the audit subsystem. These include process execution, user ID changes, network operations, and changes to authentication, scheduling, services, and logging configuration.
Collection Requirements
- audit rules from the module's Auditbeat configuration; see Configuring Infrastructure Sources
auditdcollection configuration; see Connecting and Configuring Data Collection
MITRE ATT&CK Coverage
The source rules cover the following tactics.
- reconnaissance
- resource development
- initial access
- execution
- persistence
- privilege escalation
- stealth
- defense impairment
- credential access
- discovery
- lateral movement
- collection
- command and control
- exfiltration
- impact
Lookups
The source rules enrich incidents with context from infrastructure and account lookups, while exclusion lookups filter out legitimate activity. See Lookups for population requirements.
The "Cyber Security Expertise Description" document included with the module lists the source rules, their MITRE ATT&CK tactics and techniques, identifiers, and lookups.