Repository navigation

Commit 88c64da

committed

Add Linux auditd audit rules removed dataset (T1562.001)

CONFIG_CHANGE op=remove_rule records of a runtime audit-rule flush (auditctl -D / AUDIT_DEL) with no matching add_rule - the telemetry a mass audit-rule removal produces - captured on an authorized lab host. For the Linux Auditd Audit Rules Removed detection.

1 parent f08d681 commit 88c64daCopy full SHA for 88c64da

1 file changed

datasets/attack_techniques/T1562.001/linux_auditd_rules_removed
- linux_auditd_rules_removed.log

`‎datasets/attack_techniques/T1562.001/linux_auditd_rules_removed/linux_auditd_rules_removed.log‎`

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:3e40a3f70437392b7e721d9afd7f0df6add931aacc5d330c712ae4cffef24022`
	`3`	`+size 1156`

Comments

(0)