LOADING N0PERM…
Linux Kernel audit configuration utility. Controls rules for syscall telemetry, file integrity monitoring, and privilege elevation tracking.
A standard LINUX utility used across offensive reconnaissance, packet forensics, and defensive system administration.
Direct visibility into network interfaces, protocol frames, access controls, or filesystem structures without graphical overhead.
During live system triage, initial reconnaissance, forensic capture inspection, or baseline configuration auditing.
# Debian / Ubuntu
sudo apt install auditd
# RHEL / Rocky / Fedora
sudo dnf install auditAudit rule configuration:
- Monitor modifications to /etc/passwd: sudo auditctl -w /etc/passwd -p wa -k identity_tampering
- Monitor execve syscalls for SUID executions: sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k elevated_exec
- List currently active audit rules: sudo auditctl -l
- Delete all active rules: sudo auditctl -D