Hhmmm......here's my dilemma. My field called proctitle has the entire command in it. One example is where I have proctitle="/bin/chmod 440 /etc/sudoers" and I want to exclude the chmod term. I ...
See more...
Hhmmm......here's my dilemma. My field called proctitle has the entire command in it. One example is where I have proctitle="/bin/chmod 440 /etc/sudoers" and I want to exclude the chmod term. I have 32 such terms I need to exclude. I'll share with you that I am attempting to develop a Linux auditd detection for Account Manipulation per the Mitre Attack Framework https://attack.mitre.org/techniques/T1098/. This search will look for attempts to modify the sshd_config, passwd, groups, shadow and sudoer file. In examining existing data, I have determined there are legitimate processes (the 32 terms mentioned) in the proctitle field for the event data that will trigger this alert. (It was a tedious effort, but I traced through the parent process IDs to come justify this list.) If I eliminate these 32, my noise is 99% filtered out. Most of my terms are bounded by major breaks. The example I used is not, but if I use /bin/chmod instead of chmod, it would work. Let me try this and report back.