linux:auditd SYSCALL:read
SYSCALL record for read
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- Tier, host type
- Recommended
- Techniques
- 12
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Recommended | |
| Linux web server, internet-facing | Recommended |
Techniques it helps detect
- T1003.007 Proc Filesystem
- T1003.008 /etc/passwd and /etc/shadow
- T1025 Data from Removable Media
- T1039 Data from Network Shared Drive
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1052.001 Exfiltration over USB
- T1056 Input Capture
- T1056.001 Keylogging
- T1120 Peripheral Device Discovery
- T1201 Password Policy Discovery
- T1555 Credentials from Password Stores
- T1700 AI-Enabled Exfiltration
Rules that depend on it
No vendor rule names this event or source directly.