linux:auditd SYSCALL:connect
SYSCALL record for connect
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- Tier, host type
- Recommended
- Techniques
- 20
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Recommended | |
| Linux web server, internet-facing | Recommended |
Techniques it helps detect
- T1001 Data Obfuscation
- T1027.003 Steganography
- T1030 Data Transfer Size Limits
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1095 Non-Application Layer Protocol
- T1102 Web Service
- T1102.001 Dead Drop Resolver
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1199 Trusted Relationship
- T1218 System Binary Proxy Execution
- T1568 Dynamic Resolution
- T1568.001 Fast Flux DNS
- T1568.002 Domain Generation Algorithms
- T1568.003 DNS Calculation
- T1700 AI-Enabled Exfiltration
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destinationAppendix B item 5(2) | Supports an activity | our analysis: connect syscalls with SOCKADDR |