linux:auditd SYSCALL:chown
SYSCALL record for chown
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
DISA STIG (linux)
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Recommended | DISA STIG (linux) |
| Linux web server, internet-facing | Recommended | DISA STIG (linux) |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| DISA STIG: Audit rules (auditd)Red Hat Enterprise Linux 9 V2R10 (2026-10-05) | Names this event | RHEL-09-654020 (linux): chown;fchown;fchownat;lchown key perm_mod |