linux:auditd SYSCALL
System call record
One record per audited system call, with the syscall name, result, pid, ppid, auid, uid, euid, comm and exe. The event key SYSCALL:<name> in this reference means a SYSCALL record for that syscall.
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- How to enable
- auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools.
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Splunk 13
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Recommended | |
| Linux web server, internet-facing | Recommended |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Splunk 13
- Linux Auditd At Application Execution
- Linux Auditd Copy Fail Privilege Escalation
- Linux Auditd Data Transfer Size Limits Via Split Syscall
- Linux Auditd Doas Tool Execution
- Linux Auditd Edit Cron Table Parameter
- Linux Auditd Insert Kernel Module Using Insmod Utility
- Linux Auditd Install Kernel Module Using Modprobe Utility
- Linux Auditd Kernel Module Enumeration
- Linux Auditd Kernel Module Using Rmmod Utility
- Linux Auditd System Network Configuration Discovery
- Linux Auditd Whoami User Discovery
- Linux Dirty Frag Kernel Privilege Escalation
- Linux Suspicious Namespace Creation