Skip to content
Sign In
Telemetry

linux:auditd USER_CMD

User command

A command run through sudo or a similar user-space tool.

Log source
Linux audit framework (auditd)
Host type
Linux
How to enable
auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools.
Tier, host type
Recommended
Techniques
1
Rules depending on it
none

Why this tier

By role

RoleTierBasis
Linux serverRecommended
Linux web server, internet-facingRecommended

Techniques it helps detect

Rules that depend on it

No vendor rule names this event or source directly.

Standards and guidance naming it

RequirementRelationBasis
OMB M-26-14: Privilege changesAppendix B item 5(4)Supports an activityour analysis: sudo commands

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.