v0.2.0

v0.2.0

This release establishes the new simplified baseline of the auditd ruleset.

v0.1.0 preserved the historic, broad pre-simplification baseline from the old master. v0.2.0 is the first release of the streamlined model now used on master.

Core Principle

The ruleset is now intentionally telemetry-first.

The goal of audit.rules is to collect broad, attributable, reusable host telemetry. It should not try to encode every suspicious binary, shell, admin tool, or attacker workflow directly in the audit layer. In other words: the audit ruleset is the sensor, not the detection engine.

Detection logic belongs downstream in Sigma rules, SIEM queries, Aurora Linux, or other analytics that can correlate context, reduce noise, and evolve faster than a static auditd config.

That shift makes the ruleset:

• simpler to understand and maintain
• more portable across Linux distributions and libaudit variants
• less brittle than long lists of hard-coded per-binary detections
• easier to validate in CI and test before deployment
• better suited as a common telemetry source for multiple downstream tools

What Changed

Simplified execution coverage

• Added generic process_creation coverage with execve and execveat for both arch=b32 and arch=b64.
• Removed many per-binary execution watches that duplicated the same telemetry and pushed narrow detection logic into the ruleset.

Broader reusable telemetry

• Added or retained broad coverage that downstream detections can build on more effectively:
  • writes to /bin, /usr, and /boot
  • socket creation
  • permission-denied access by system accounts and daemons
  • exploitation-oriented primitives such as ptrace, memfd_create, bpf, unshare, setns, process_vm_*, io_uring_setup, and userfaultfd
  • package manager and container configuration changes

Portability and correctness improvements

• Documented UID_MIN assumptions and normalized auid!=unset handling in interactive-user rules.
• Removed distro-specific time-daemon assumptions from the default time rules.
• Avoided less portable syscall names where libaudit compatibility was inconsistent.
• Kept -i enabled so optional distro-specific paths do not abort loading by default.

Validation and maintainability

• Added CI linting for rule syntax and structure.
• Added Ubuntu-based load validation for both a portable CI copy and a strict copy without -i.
• Improved documentation around validation, UID_MIN, and the new detection-agnostic design.

Coverage Summary

This release keeps broad coverage across:

• audit integrity and audit configuration
• noise filters and portability-oriented exclusions
• kernel, module, mount, swap, and time changes
• cron, identity stores, PAM, sudo, and login state
• network, firewall, startup, boot-path, library, SSH, systemd, and MAC policy changes
• failed access attempts, DAC changes, session files, and privilege-abuse heuristics
• exploitation-adjacent primitives and special syscalls
• package manager, container, and selected security-tooling configuration
• high-volume telemetry such as process creation, file deletion and access failures, socket creation, and 32-bit ABI usage

Notes

• v0.1.0 remains available as the preserved historic baseline.
• v0.2.0 is the recommended starting point if you want the simplified, maintainable, detection-agnostic ruleset.
• If you prefer strict pre-deployment validation, test a temporary copy with -i removed before rollout.

v0.1.0

v0.1.0

This release captures the long-running master baseline of the auditd ruleset before the broader simplification and CI modernization that follow in PR #173.

It reflects years of contributions, merged improvements, distro-specific additions, and practical tuning gathered into the default configuration over time. The result is a broad best-practice auditd baseline that aims to work on many Linux systems while covering a wide range of security-relevant events.

What This Version Covers

Self-auditing and audit integrity

• Audit log access: reads and modifications to /var/log/audit/ and related audit log locations.
• Audit configuration: changes to /etc/audit/, libaudit, and audisp configuration.
• Audit management tooling: execution of tools such as auditctl, auditd, and augenrules.
• Audit trail access: execution of reporting and search tools such as ausearch, aureport, aulast, aulastlogin, and auvirt.

Event filtering and noise reduction

• Optional suppression of CWD records.
• Filtering of noisy cron-related events via SELinux subject types.
• Suppression of chrony time-adjustment noise.
• Exclusion of CRYPTO_KEY_USER events on public-facing systems.
• Exclusion of Open VM Tools chatter.
• High-volume filters for locations such as /dev/shm and /var/lock/lvm.
• Filebeat-related path monitoring and filtering, including Linux and Homebrew-style paths.

Core system integrity and kernel-level activity

• Kernel parameter changes through sysctl configuration.
• Kernel module loading and unloading via insmod, modprobe, rmmod, and module syscalls.
• Modprobe configuration changes.
• Kexec usage.
• Creation of special files via mknod and mknodat.
• Mount, unmount, and swap operations.
• NFS mount helper execution.
• System time changes and local timezone file monitoring.
• Stunnel execution.

Scheduled tasks, identity stores, and account changes

• Cron configuration and scheduled job persistence locations.
• User, group, shadow, and password database changes.
• Sudoers file modifications.
• Password and local user/group management tool execution.
• Login-related configuration and authentication state files.

Network and host configuration

• Hostname and domain name changes.
• Successful outbound IPv4 and IPv6 connection attempts.
• A narrow remote-shell heuristic based on shell processes making network connections.
• Changes to host, resolver, and network configuration files and directories.
• Login banner changes via /etc/issue and /etc/issue.net.

Boot, startup, library, authentication, and service configuration

• Startup scripts and init configuration.
• Library search path changes and LD_PRELOAD changes.
• PAM-related configuration and security environment files.
• Mail server configuration.
• SSH server configuration and tampering with root SSH keys.
• Systemd configuration, generators, and related startup logic.
• SELinux policy changes.

Access failures, privilege transitions, and session state

• Failed access attempts against critical directories such as /etc, /bin, /usr/bin, /var, /home, and /srv.
• Execution of privilege-transition tools such as su and sudo.
• Power-state tooling such as shutdown, reboot, halt, and poweroff.
• Session tracking files such as utmp, btmp, and wtmp.
• DAC-related changes including chmod, chown, and extended attribute modifications.

Reconnaissance and suspicious activity signals

• Basic reconnaissance commands such as whoami, id, hostname, and uname.
• Suspicious networking and transfer tools such as wget, curl, nc, ncat, ssh, scp, sftp, socat, wireshark, tshark, rdesktop, and nmap.
• Service and binary coverage for UFTP and atftpd/TFTP-related activity.
• Identity and account helper activity through sssd, vte, kde4, setfiles, and dbus launch helpers.
• Compression and archive utilities associated with bulk data compression and staging.
• Additional suspicious shell coverage for uncommon shells and living-off-the-land shell helpers.
• Web-server user command execution using the default www-data UID assumption.
• Shell profile and environment configuration changes.
• Ptrace-based injection and tracing activity.
• Anonymous in-memory file creation via memfd_create.
• Root access to other users' home directories as a privilege-abuse heuristic.

Software management and admin tooling

• Native package manager execution across RPM/YUM, DNF, YAST/Zypper, APT/DPKG, and Pacman families.
• Third-party package ecosystems such as pip, pip3, pipx, npm, CPAN, RubyGems, and LuaRocks.
• String-search tooling that may be used to search for secrets or credentials.
• Configuration and state monitoring for tools such as Puppet, BigFix, Chef, Salt, and Otter.

Product- and platform-specific coverage

• CrowdStrike Falcon configuration, agent execution, and network-related rules.
• Docker binaries, configuration, storage, and systemd units.
• Virtualization tooling such as QEMU, VirtualBox, and virt-manager.
• Kubelet execution.

IPC and behavioral detections

• System V IPC calls for message queues, semaphores, and shared memory.
• High-volume shell execution logging.
• Root command execution.
• User-driven file deletions.
• Unauthorized file access, creation, and modification attempts.
• 32-bit ABI usage on 64-bit systems.
• Optional immutable mode via -e 2.

Notes

• This baseline intentionally includes -i, which means missing files, users, or paths do not abort rule loading.
• The ruleset in this release is intentionally broad and historic in nature. Later work focuses on simplifying execution coverage, improving portability, and moving more detection logic downstream into Sigma content and SIEM queries.