linux:auditd SYSCALL:write
SYSCALL record for write
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- Tier, host type
- Recommended
- Techniques
- 32
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Recommended | |
| Linux web server, internet-facing | Recommended |
Techniques it helps detect
- T1003.007 Proc Filesystem
- T1027 Obfuscated Files or Information
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.011 Fileless Storage
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1048 Exfiltration Over Alternative Protocol
- T1053 Scheduled Task/Job
- T1053.002 At
- T1053.003 Cron
- T1056 Input Capture
- T1056.003 Web Portal Capture
- T1080 Taint Shared Content
- T1105 Ingress Tool Transfer
- T1114.003 Email Forwarding Rule
- T1123 Audio Capture
- T1176.002 IDE Extensions
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1491 Defacement
- T1491.001 Internal Defacement
- T1505.002 Transport Agent
- T1546.016 Installer Packages
- T1546.017 Udev Rules
- T1547 Boot or Logon Autostart Execution
- T1554 Compromise Host Software Binary
- T1556 Modify Authentication Process
- T1556.003 Pluggable Authentication Modules
- T1557 Adversary-in-the-Middle
- T1569 System Services
Rules that depend on it
No vendor rule names this event or source directly.