linux:auditd USER_ROLE_CHANGE
User role change
A user's SELinux role was changed.
- Log source
- Linux audit framework (auditd)
- Host type
- Linux
- How to enable
- auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools.
- Tier, host type
- Listed
- Techniques
- 0
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Listed | |
| Linux web server, internet-facing | Listed |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Privilege changesAppendix B item 5(4) | Supports an activity | our analysis |