Skip to content

bfuzzy/auditd-attack

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

31 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

auditd-attack

A Linux Auditd rule set mapped to MITRE's Attack Framework

Disclaimer

Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once (although that'd be ideal) it is setup to serve as guidance toward increasing detection/hunting coverage.

WIKI

WIKI

Special Thanks To:

Eric Gershman

iase.disa.mil

cyb3rops

ugurengin

checkraze

auditdBroFramework

@MITREattack

TODO

  • Increase MITRE ATT&CK coverage
  • Test rules across multiple flavors of Linux
  • Determine performance impacts of the ruleset

About

A Linux Auditd rule set mapped to MITRE's Attack Framework

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published