On Thursday, July 30, 2020 1:54:09 PM EDT Todd Heberlein wrote: Yes, this is common. Most people are interested in the actions that people take on the machine rather than normal system functioning. A couple of ways. 1) remove the auid!=-1. That will get you all daemons. 2) Use audit by executable rules: -a always,exit -F arch=b64 -S execve -F exe=/usr/sbin/httpd -F key=httpd-exec -Steve

On Thursday, July 30, 2020 2:47:05 PM EDT Todd Heberlein wrote: The audit rules are designed to common criteria, STIG, PCI-DS, etc. To date, no one has articulated any rules that need to be written against any server. The rule naming scheme recognizes that may be a possibility and set aside rules that start with 50- specifically for server rules. But with some many daemons, where to start? And what to monitor? If you are thinking about intrusion detection, then I have been working on that problem for a while. There are specific rules that detect specific actions. But unless you've thought of everything, there is always a hole. Once they get inside, they probably want to do recon to see what they have to work with. -a always,exit -F perm=x -F path=/usr/bin/uname -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/rpm -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/yum -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/dnf -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/w -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/who -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/whoami -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/id -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/netstat -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/ss -F key=ids-recon -a always,exit -F perm=x -F path=/usr/bin/route -F key=ids-recon ...etc. But then they might want to use a tool downloaded to escalate. You might be able to detect them making it executable: -a exit,always -F arch=b64 -S chmod,fchmod -F dir=/home -F a1&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec -a exit,always -F arch=b64 -S fchmodat -F dir=/home -F a2&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec -a exit,always -F arch=b64 -S chmod,fchmod -F dir=/tmp -F a1&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec -a exit,always -F arch=b64 -S fchmodat -F dir=/tmp -F a2&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec -a exit,always -F arch=b64 -S chmod,fchmod -F dir=/var/tmp -F a1&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec -a exit,always -F arch=b64 -S fchmodat -F dir=/var/tmp -F a2&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec -a exit,always -F arch=b64 -S chmod,fchmod -F dir=/dev/shm -F a1&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec -a exit,always -F arch=b64 -S fchmodat -F dir=/dev/shm -F a2&0111 -F filetype=file -F auid>=1000 -F auid!=-1 -F key=ids-mkexec There's a lot of rules to add. And this will get noisy because many system scripts do things that look like recon. Update looks like mkexec. What I'd recommend is also looking at something like fapolicyd to prevent execution of any downloaded tools. That will give a bigger signal to noise ratio that trying to craft some audit rules. Because ultimately, audit can tell you something was executed. It can't tell you the software doesn't belong on the system. -Steve