linux:auditd SYSCALL:open
SYSCALL record for open
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- Tier, host type
- Minimum
- Techniques
- 50
- Rules depending on it
- none
Why this tier
DISA STIG (linux)
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Minimum | DISA STIG (linux) |
| Linux web server, internet-facing | Minimum | DISA STIG (linux) |
Techniques it helps detect
- T1003 OS Credential Dumping
- T1003.007 Proc Filesystem
- T1003.008 /etc/passwd and /etc/shadow
- T1005 Data from Local System
- T1025 Data from Removable Media
- T1027 Obfuscated Files or Information
- T1027.001 Binary Padding
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.011 Fileless Storage
- T1027.017 SVG Smuggling
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1048 Exfiltration Over Alternative Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1055 Process Injection
- T1055.014 VDSO Hijacking
- T1056 Input Capture
- T1056.001 Keylogging
- T1070 Indicator Removal
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1114 Email Collection
- T1119 Automated Collection
- T1120 Peripheral Device Discovery
- T1123 Audio Capture
- T1176.001 Browser Extensions
- T1176.002 IDE Extensions
- T1195 Supply Chain Compromise
- T1200 Hardware Additions
- T1201 Password Policy Discovery
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1480 Execution Guardrails
- T1480.002 Mutual Exclusion
- T1491.001 Internal Defacement
- T1546.005 Trap
- T1546.017 Udev Rules
- T1547.013 XDG Autostart Entries
- T1554 Compromise Host Software Binary
- T1555 Credentials from Password Stores
- T1556 Modify Authentication Process
- T1556.003 Pluggable Authentication Modules
- T1557 Adversary-in-the-Middle
- T1700 AI-Enabled Exfiltration
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Object and data eventsAppendix B item 5(3) | Supports an activity | our analysis |
| DISA STIG: Audit rules (auditd)Red Hat Enterprise Linux 9 V2R10 (2026-10-05) | Names this event | RHEL-09-654070 (linux): truncate;ftruncate;creat;open;openat;open_by_handle_at key perm_access |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Elastic Defend endpoint events | file | Partial | our analysis: failed opens (EACCES, EPERM) that the RHEL STIG audits are not sensor file events |