security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
36394d43a03bd05e13b83ff99de8580c8a33d659
blue-team-tools/rules/linux/auditd
T
History
Milad Cheraghi a719612ab8 Merge PR #5098 from @CheraghiMilad - Update Service Reload or Start - Linux 
update: Service Reload or Start - Linux - Add additional flags and binaries used to changes services status

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
2025-03-05 00:50:23 +01:00
..
lnx_auditd_audio_capture.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_auditing_config_change.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_binary_padding.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_bpfdoor_file_accessed.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_bpfdoor_port_redirect.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_capabilities_discovery.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_change_file_time_attr.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_chattr_immutable_removal.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_clipboard_collection.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_clipboard_image_collection.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_coinminer.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_create_account.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_data_compressed.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_data_exfil_wget.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_dd_delete_file.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_disable_system_firewall.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_file_or_folder_permissions.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_find_cred_in_files.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_hidden_binary_execution.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_hidden_files_directories.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_hidden_zip_files_steganography.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_keylogging_with_pam_d.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_ld_so_preload_mod.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_load_module_insmod.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_logging_config_change.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_masquerading_crond.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_modify_system_firewall.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_network_service_scanning.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_network_sniffing.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_password_policy_discovery.yml
Merge PR #5102 from @CheraghiMilad - Update Password Policy Discovery - Linux
2024-12-01 14:09:27 +01:00
lnx_auditd_screencapture_import.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_screencaputre_xwd.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_split_file_into_pieces.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_steghide_embed_steganography.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_steghide_extract_steganography.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_susp_c2_commands.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_susp_cmds.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_susp_exe_folders.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_susp_histfile_operations.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_susp_service_reload_or_restart.yml
Merge PR #5098 from @CheraghiMilad - Update Service Reload or Start - Linux
2025-03-05 00:50:23 +01:00
lnx_auditd_system_info_discovery2.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_system_info_discovery.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_system_shutdown_reboot.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_systemd_service_creation.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_unix_shell_configuration_modification.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_unzip_hidden_zip_files_steganography.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
lnx_auditd_user_discovery.yml
Merge PR #5097 from @CheraghiMilad - Update System Owner or User Discovery - Linux
2024-12-01 13:51:14 +01:00
lnx_auditd_web_rce.yml
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00