Perfect, thanks so much Steve.
Joshua Ammons Senior SIEM Engineer, Cybersecurity
Global Business Services
Office 479.204.4472 | Mobile 479.595.2291
***@walmart.com
WalmartÂ
805 Moberly Ln
Bentonville, ARÂ 72716
Save money. Live better.
-----Original Message-----
From: Steve Grubb [mailto:***@redhat.com]
Sent: Monday, June 11, 2018 9:28 AM
To: linux-***@redhat.com
Cc: Joshua Ammons <***@walmart.com>
Subject: EXT: Re: auditd rule error
Post by Joshua Ammons-a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/su -F
key=10.2.5.b-elevated-privs-session
From what I have found it seems "exe" may not be a valid field on this
specific O.S. - is this correct?
That might have been targeted for the 7.4 kernel.
Post by Joshua AmmonsDoes anyone have any recommendations on how to track elevated
privileges for all RHEL 6/7 systems?
The exe field is used for what we call audit by executable. This is for when you want to zero in on a particular program performing some action like calling accept. If you simply want notification that an application was invoked, the you would just setup a watch for execute.
-a always,exit -F path=/usr/bin/su -F perm=x -F key=10.2.5.b-elevated-privs- session
That should work across RHEL 6 & 7. Also, you will get events from pam as the user authenticates and starts the session. So, you should be able to find those with this search:
ausearch --start today -x /usr/bin/su -m USER_START -w -i
-Steve