analyzing-linux-audit-logs-for-intrusion

1# Analyzing Linux Audit Logs for Intrusion
2 
3## When to Use
4 
5- Investigating suspected unauthorized access or privilege escalation on Linux hosts
6- Hunting for evidence of exploitation, backdoor installation, or persistence mechanisms
7- Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring
8- Reconstructing a timeline of attacker actions during incident response
9- Detecting file tampering on critical system files such as `/etc/passwd`, `/etc/shadow`, or SSH keys
10 
11**Do not use** for network-level intrusion detection; use Suricata or Zeek for network traffic analysis. Auditd operates at the kernel level on individual hosts.
12 
13## Prerequisites
14 
15- Linux system with `auditd` package installed and the audit daemon running (`systemctl status auditd`)
16- Root or sudo access to configure audit rules and query logs
17- Audit rules deployed via `/etc/audit/rules.d/*.rules` or loaded with `auditctl`
18- Recommended: Neo23x0/auditd ruleset from GitHub for comprehensive baseline coverage
19- Familiarity with Linux syscalls (`execve`, `open`, `connect`, `ptrace`, etc.)
20- Log storage with sufficient retention (default location: `/var/log/audit/audit.log`)
21 
22## Workflow
23 
24### Step 1: Verify Audit Daemon Status and Configuration
25 
26Confirm the audit system is running and check the current rule set:
27 
28```bash
29# Check auditd service status
30systemctl status auditd
31 
32# Show current audit rules loaded in the kernel
33auditctl -l
34 
35# Show audit daemon configuration
36…