domains / families / security / analyzing-linux-audit-logs-for-intrusion

analyzing-linux-audit-logs-for-intrusion

separate

'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

When to use

• Investigating suspected unauthorized access or privilege escalation on Linux hosts
• Hunting for evidence of exploitation, backdoor installation, or persistence mechanisms
• Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring
• Reconstructing a timeline of attacker actions during incident response
• Detecting file tampering on critical system files such as `/etc/passwd`, `/etc/shadow`, or SSH keys

When not to use

• network-level intrusion detection
• network traffic analysis

Skill page

Source