Linux audit framework (auditd)

License or service

Linux Audit userspace

What is free

Distro-packaged

What costs

Nothing

Vendor page

https://man7.org/linux/man-pages/man8/auditd.8.html

As read on

2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

• T1001 Data Obfuscation
• T1001.001 Junk Data
• T1001.002 Steganography
• T1001.003 Protocol or Service Impersonation
• T1003 OS Credential Dumping
• T1003.005 Cached Domain Credentials
• T1003.007 Proc Filesystem
• T1003.008 /etc/passwd and /etc/shadow
• T1005 Data from Local System
• T1007 System Service Discovery
• T1008 Fallback Channels
• T1010 Application Window Discovery
• T1011 Exfiltration Over Other Network Medium
• T1011.001 Exfiltration Over Bluetooth
• T1014 Rootkit
• T1016 System Network Configuration Discovery
• T1016.001 Internet Connection Discovery
• T1016.002 Wi-Fi Discovery
• T1018 Remote System Discovery
• T1020 Automated Exfiltration
• T1021 Remote Services
• T1021.004 SSH
• T1021.005 VNC
• T1025 Data from Removable Media
• T1027 Obfuscated Files or Information
• T1027.001 Binary Padding
• T1027.002 Software Packing
• T1027.003 Steganography
• T1027.004 Compile After Delivery
• T1027.005 Indicator Removal from Tools
• T1027.006 HTML Smuggling
• T1027.008 Stripped Payloads
• T1027.009 Embedded Payloads
• T1027.010 Command Obfuscation
• T1027.011 Fileless Storage
• T1027.013 Encrypted/Encoded File
• T1027.014 Polymorphic Code
• T1027.015 Compression
• T1027.016 Junk Code Insertion
• T1027.017 SVG Smuggling
• T1027.018 Invisible Unicode
• T1029 Scheduled Transfer
• T1030 Data Transfer Size Limits
• T1033 System Owner/User Discovery
• T1036 Masquerading
• T1036.002 Right-to-Left Override
• T1036.003 Rename Legitimate Utilities
• T1036.004 Masquerade Task or Service
• T1036.005 Match Legitimate Resource Name or Location
• T1036.006 Space after Filename
• T1036.008 Masquerade File Type
• T1036.009 Break Process Trees
• T1036.010 Masquerade Account Name
• T1036.011 Overwrite Process Arguments
• T1036.012 Browser Fingerprint
• T1037 Boot or Logon Initialization Scripts
• T1037.004 RC Scripts
• T1039 Data from Network Shared Drive
• T1040 Network Sniffing
• T1041 Exfiltration Over C2 Channel
• T1046 Network Service Discovery
• T1048 Exfiltration Over Alternative Protocol
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1049 System Network Connections Discovery
• T1052 Exfiltration Over Physical Medium
• T1052.001 Exfiltration over USB
• T1053 Scheduled Task/Job
• T1053.002 At
• T1053.003 Cron
• T1053.006 Systemd Timers
• T1055 Process Injection
• T1055.008 Ptrace System Calls
• T1055.009 Proc Memory
• T1055.014 VDSO Hijacking
• T1056 Input Capture
• T1056.001 Keylogging
• T1056.002 GUI Input Capture
• T1056.003 Web Portal Capture
• T1056.004 Credential API Hooking
• T1057 Process Discovery
• T1059 Command and Scripting Interpreter
• T1059.004 Unix Shell
• T1059.005 Visual Basic
• T1059.006 Python
• T1059.007 JavaScript
• T1059.011 Lua
• T1059.013 Container CLI/API
• T1068 Exploitation for Privilege Escalation
• T1069 Permission Groups Discovery
• T1069.001 Local Groups
• T1069.002 Domain Groups
• T1070 Indicator Removal
• T1070.003 Clear Command History
• T1070.004 File Deletion
• T1070.006 Timestomp
• T1070.007 Clear Network Connection History and Configurations
• T1070.008 Clear Mailbox Data
• T1070.009 Clear Persistence
• T1070.010 Relocate Malware
• T1071 Application Layer Protocol
• T1071.001 Web Protocols
• T1071.002 File Transfer Protocols
• T1071.003 Mail Protocols
• T1071.004 DNS
• T1071.005 Publish/Subscribe Protocols
• T1072 Software Deployment Tools
• T1074 Data Staged
• T1074.001 Local Data Staging
• T1074.002 Remote Data Staging
• T1078 Valid Accounts
• T1078.001 Default Accounts
• T1078.002 Domain Accounts
• T1078.003 Local Accounts
• T1080 Taint Shared Content
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1087 Account Discovery
• T1087.001 Local Account
• T1087.002 Domain Account
• T1090 Proxy
• T1090.001 Internal Proxy
• T1090.002 External Proxy
• T1090.003 Multi-hop Proxy
• T1090.004 Domain Fronting
• T1092 Communication Through Removable Media
• T1095 Non-Application Layer Protocol
• T1098 Account Manipulation
• T1098.004 SSH Authorized Keys
• T1098.007 Additional Local or Domain Groups
• T1102 Web Service
• T1102.001 Dead Drop Resolver
• T1102.002 Bidirectional Communication
• T1102.003 One-Way Communication
• T1104 Multi-Stage Channels
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1110 Brute Force
• T1110.002 Password Cracking
• T1113 Screen Capture
• T1114 Email Collection
• T1114.003 Email Forwarding Rule
• T1115 Clipboard Data
• T1119 Automated Collection
• T1120 Peripheral Device Discovery
• T1123 Audio Capture
• T1124 System Time Discovery
• T1125 Video Capture
• T1129 Shared Modules
• T1132 Data Encoding
• T1132.001 Standard Encoding
• T1132.002 Non-Standard Encoding
• T1133 External Remote Services
• T1135 Network Share Discovery
• T1136 Create Account
• T1136.001 Local Account
• T1136.002 Domain Account
• T1140 Deobfuscate/Decode Files or Information
• T1176 Software Extensions
• T1176.001 Browser Extensions
• T1176.002 IDE Extensions
• T1189 Drive-by Compromise
• T1190 Exploit Public-Facing Application
• T1195 Supply Chain Compromise
• T1195.001 Compromise Software Dependencies and Development Tools
• T1195.002 Compromise Software Supply Chain
• T1195.003 Compromise Hardware Supply Chain
• T1199 Trusted Relationship
• T1200 Hardware Additions
• T1201 Password Policy Discovery
• T1203 Exploitation for Client Execution
• T1204 User Execution
• T1204.001 Malicious Link
• T1204.002 Malicious File
• T1204.003 Malicious Image
• T1204.004 Malicious Copy and Paste
• T1204.005 Malicious Library
• T1205 Traffic Signaling
• T1205.001 Port Knocking
• T1205.002 Socket Filters
• T1210 Exploitation of Remote Services
• T1211 Exploitation for Stealth
• T1212 Exploitation for Credential Access
• T1213 Data from Information Repositories
• T1213.006 Databases
• T1217 Browser Information Discovery
• T1218 System Binary Proxy Execution
• T1218.015 Electron Applications
• T1219 Remote Access Tools
• T1219.001 IDE Tunneling
• T1219.002 Remote Desktop Software
• T1219.003 Remote Access Hardware
• T1222 File and Directory Permissions Modification
• T1222.002 Linux and Mac Permissions
• T1480 Execution Guardrails
• T1480.001 Environmental Keying
• T1480.002 Mutual Exclusion
• T1485 Data Destruction
• T1486 Data Encrypted for Impact
• T1489 Service Stop
• T1490 Inhibit System Recovery
• T1491 Defacement
• T1491.001 Internal Defacement
• T1491.002 External Defacement
• T1495 Firmware Corruption
• T1496 Resource Hijacking
• T1496.001 Compute Hijacking
• T1496.002 Bandwidth Hijacking
• T1497 Virtualization/Sandbox Evasion
• T1497.001 System Checks
• T1497.002 User Activity Based Checks
• T1497.003 Time Based Checks
• T1498 Network Denial of Service
• T1498.001 Direct Network Flood
• T1498.002 Reflection Amplification
• T1499 Endpoint Denial of Service
• T1499.001 OS Exhaustion Flood
• T1499.002 Service Exhaustion Flood
• T1499.003 Application Exhaustion Flood
• T1499.004 Application or System Exploitation
• T1505 Server Software Component
• T1505.001 SQL Stored Procedures
• T1505.002 Transport Agent
• T1505.003 Web Shell
• T1518 Software Discovery
• T1518.001 Security Software Discovery
• T1518.002 Backup Software Discovery
• T1529 System Shutdown/Reboot
• T1531 Account Access Removal
• T1534 Internal Spearphishing
• T1539 Steal Web Session Cookie
• T1542 Pre-OS Boot
• T1542.002 Component Firmware
• T1542.003 Bootkit
• T1543 Create or Modify System Process
• T1543.002 Systemd Service
• T1543.005 Container Service
• T1546 Event Triggered Execution
• T1546.004 Unix Shell Configuration Modification
• T1546.005 Trap
• T1546.016 Installer Packages
• T1546.017 Udev Rules
• T1546.018 Python Startup Hooks
• T1547 Boot or Logon Autostart Execution
• T1547.006 Kernel Modules and Extensions
• T1547.013 XDG Autostart Entries
• T1548 Abuse Elevation Control Mechanism
• T1548.001 Setuid and Setgid
• T1548.003 Sudo and Sudo Caching
• T1550 Use Alternate Authentication Material
• T1552 Unsecured Credentials
• T1552.001 Credentials In Files
• T1552.003 Shell History
• T1552.004 Private Keys
• T1553 Subvert Trust Controls
• T1553.004 Install Root Certificate
• T1554 Compromise Host Software Binary
• T1555 Credentials from Password Stores
• T1555.002 Securityd Memory
• T1555.003 Credentials from Web Browsers
• T1555.005 Password Managers
• T1556 Modify Authentication Process
• T1556.003 Pluggable Authentication Modules
• T1556.006 Multi-Factor Authentication
• T1557 Adversary-in-the-Middle
• T1557.002 ARP Cache Poisoning
• T1558 Steal or Forge Kerberos Tickets
• T1558.005 Ccache Files
• T1559 Inter-Process Communication
• T1560 Archive Collected Data
• T1560.001 Archive via Utility
• T1560.002 Archive via Library
• T1560.003 Archive via Custom Method
• T1561 Disk Wipe
• T1561.001 Disk Content Wipe
• T1561.002 Disk Structure Wipe
• T1563 Remote Service Session Hijacking
• T1563.001 SSH Hijacking
• T1564 Hide Artifacts
• T1564.001 Hidden Files and Directories
• T1564.002 Hidden Users
• T1564.003 Hidden Window
• T1564.005 Hidden File System
• T1564.006 Run Virtual Instance
• T1564.007 VBA Stomping
• T1564.008 Email Hiding Rules
• T1564.011 Ignore Process Interrupts
• T1564.012 File/Path Exclusions
• T1564.013 Bind Mounts
• T1564.014 Extended Attributes
• T1565 Data Manipulation
• T1565.001 Stored Data Manipulation
• T1565.002 Transmitted Data Manipulation
• T1565.003 Runtime Data Manipulation
• T1566 Phishing
• T1566.001 Spearphishing Attachment
• T1566.002 Spearphishing Link
• T1566.003 Spearphishing via Service
• T1567 Exfiltration Over Web Service
• T1567.001 Exfiltration to Code Repository
• T1567.002 Exfiltration to Cloud Storage
• T1567.003 Exfiltration to Text Storage Sites
• T1567.004 Exfiltration Over Webhook
• T1568 Dynamic Resolution
• T1568.001 Fast Flux DNS
• T1568.002 Domain Generation Algorithms
• T1568.003 DNS Calculation
• T1569 System Services
• T1569.003 Systemctl
• T1570 Lateral Tool Transfer
• T1571 Non-Standard Port
• T1572 Protocol Tunneling
• T1573 Encrypted Channel
• T1573.001 Symmetric Cryptography
• T1573.002 Asymmetric Cryptography
• T1574 Hijack Execution Flow
• T1574.006 Dynamic Linker Hijacking
• T1574.007 Path Interception by PATH Environment Variable
• T1606 Forge Web Credentials
• T1606.001 Web Cookies
• T1611 Escape to Host
• T1614 System Location Discovery
• T1614.001 System Language Discovery
• T1620 Reflective Code Loading
• T1621 Multi-Factor Authentication Request Generation
• T1622 Debugger Evasion
• T1649 Steal or Forge Authentication Certificates
• T1652 Device Driver Discovery
• T1653 Power Settings
• T1654 Log Enumeration
• T1657 Financial Theft
• T1659 Content Injection
• T1665 Hide Infrastructure
• T1667 Email Bombing
• T1668 Exclusive Control
• T1669 Wi-Fi Networks
• T1673 Virtual Machine Discovery
• T1674 Input Injection
• T1678 Delay Execution
• T1680 Local Storage Discovery
• T1684 Social Engineering
• T1684.001 Impersonation
• T1685 Disable or Modify Tools
• T1685.003 Modify or Spoof Tool UI
• T1685.004 Disable or Modify Linux Audit System Log
• T1685.006 Clear Linux or Mac System Logs
• T1686 Disable or Modify System Firewall
• T1687 Exploitation for Defense Impairment
• T1689 Downgrade Attack
• T1690 Prevent Command History Logging
• T1700 AI-Enabled Exfiltration