diff --git a/rules/linux/lnx_binary_padding.yml b/rules/linux/auditd/lnx_auditd_binary_padding.yml
similarity index 100%
rename from rules/linux/lnx_binary_padding.yml
rename to rules/linux/auditd/lnx_auditd_binary_padding.yml
diff --git a/rules/linux/lnx_change_file_time_attr.yml b/rules/linux/auditd/lnx_auditd_change_file_time_attr.yml
similarity index 100%
rename from rules/linux/lnx_change_file_time_attr.yml
rename to rules/linux/auditd/lnx_auditd_change_file_time_attr.yml
diff --git a/rules/linux/lnx_chattr_immutable_removal.yml b/rules/linux/auditd/lnx_auditd_chattr_immutable_removal.yml
similarity index 100%
rename from rules/linux/lnx_chattr_immutable_removal.yml
rename to rules/linux/auditd/lnx_auditd_chattr_immutable_removal.yml
diff --git a/rules/linux/lnx_dd_delete_file.yml b/rules/linux/auditd/lnx_auditd_dd_delete_file.yml
similarity index 100%
rename from rules/linux/lnx_dd_delete_file.yml
rename to rules/linux/auditd/lnx_auditd_dd_delete_file.yml
diff --git a/rules/linux/lnx_file_or_folder_permissions.yml b/rules/linux/auditd/lnx_auditd_file_or_folder_permissions.yml
similarity index 100%
rename from rules/linux/lnx_file_or_folder_permissions.yml
rename to rules/linux/auditd/lnx_auditd_file_or_folder_permissions.yml
diff --git a/rules/linux/lnx_find_cred_in_files.yml b/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml
similarity index 100%
rename from rules/linux/lnx_find_cred_in_files.yml
rename to rules/linux/auditd/lnx_auditd_find_cred_in_files.yml
diff --git a/rules/linux/lnx_password_policy_discovery.yml b/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml
similarity index 100%
rename from rules/linux/lnx_password_policy_discovery.yml
rename to rules/linux/auditd/lnx_auditd_password_policy_discovery.yml
diff --git a/rules/linux/lnx_pers_systemd_reload.yml b/rules/linux/auditd/lnx_auditd_pers_systemd_reload.yml
similarity index 100%
rename from rules/linux/lnx_pers_systemd_reload.yml
rename to rules/linux/auditd/lnx_auditd_pers_systemd_reload.yml
diff --git a/rules/linux/lnx_split_file_into_pieces.yml b/rules/linux/auditd/lnx_auditd_split_file_into_pieces.yml
similarity index 100%
rename from rules/linux/lnx_split_file_into_pieces.yml
rename to rules/linux/auditd/lnx_auditd_split_file_into_pieces.yml
diff --git a/rules/linux/lnx_susp_histfile_operations.yml b/rules/linux/auditd/lnx_auditd_susp_histfile_operations.yml
similarity index 100%
rename from rules/linux/lnx_susp_histfile_operations.yml
rename to rules/linux/auditd/lnx_auditd_susp_histfile_operations.yml
diff --git a/rules/linux/lnx_system_shutdown_reboot.yml b/rules/linux/auditd/lnx_auditd_system_shutdown_reboot.yml
similarity index 100%
rename from rules/linux/lnx_system_shutdown_reboot.yml
rename to rules/linux/auditd/lnx_auditd_system_shutdown_reboot.yml