Skip to content
Sign In
Telemetry

linux:auditd PROCTITLE

Process title

The full command line of the process that triggered the audit event (hex-encoded).

Log source
Linux audit framework (auditd)
Host type
Linux
How to enable
auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools.
Tier, host type
Recommended
Techniques
0
Rules depending on it
Splunk 13

Why this tier

By role

RoleTierBasis
Linux serverRecommended
Linux web server, internet-facingRecommended

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

Splunk 13

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.