CmdID

CmdID / Commands

auditctl

Utility to control the behavior, get status, and manage rules of the Linux Auditing System. tldr-pages

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from tldr-pages, CC BY 4.0

Display the status of the audit system

sudo auditctl -sIdentify

list all currently loaded audit rules

sudo auditctl -lIdentify

Delete all audit rules

sudo auditctl -DIdentify

Trips 1 Sigma rule: highAudit Rules Deleted Via Auditctl by Mohamed LAKRI

enable/disable the audit system

sudo auditctl -e 1Identify

Watch a file for changes

sudo auditctl -a always,exit -F arch=b64 -F path=/path/to/file -F perm=waIdentify

Recursively watch a directory for changes

sudo auditctl -a always,exit -F arch=b64 -F dir=/path/to/directory/ -F perm=waIdentify

Display help

auditctl -hIdentify

What detects it

Sigma process creation rules that name auditctl
highAudit Rules Deleted Via AuditctlMohamed LAKRI