analyzing-linux-audit-logs-for-intrusion
This skill provides a structured workflow for using Linux's auditd framework to investigate intrusions by monitoring system calls, file access, and privilege escalation attempts. It is used during incident response to reconstruct attacker timelines, detect unauthorized access or file tampering on critical system files, and audit compliance with security standards like CIS and STIG.
git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/analyzing-linux-audit-logs-for-intrusion && cp -r /tmp/analyzing-linux-audit-logs-for-intrusion/skills/analyzing-linux-audit-logs-for-intrusion ~/.claude/skills/analyzing-linux-audit-logs-for-intrusionSKILL.md
# Analyzing Linux Audit Logs for Intrusion ## When to Use - Investigating suspected unauthorized access or privilege escalation on Linux hosts - Hunting for evidence of exploitation, backdoor installation, or persistence mechanisms - Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring - Reconstructing a timeline of attacker actions during incident response - Detecting file tampering on critical system files such as `/etc/passwd`, `/etc/shadow`, or SSH keys **Do not use** for network-level intrusion detection; use Suricata or Zeek for network traffic analysis. Auditd operates at the kernel level on individual hosts. ## Prerequisites - Linux system with `auditd` package installed and the audit daemon running (`systemctl status auditd`) - Root or sudo access to configure audit rules and query logs - Audit rules deployed via `/etc/audit/rules.d/*.rules` or loaded with `auditctl` - Recommended: Neo23x0/auditd ruleset from GitHub for comprehensive baseline coverage - Familiarity with Linux syscalls (`execve`, `open`, `connect`, `ptrace`, etc.) - Log storage with sufficient retention (default location: `/var/log/audit/audit.log`) ## Workflow ### Step 1: Verify Audit Daemon Status and Configuration Confirm the audit system is running and check the current rule set: ```bash # Check auditd service status systemctl status auditd # Show current audit rules loaded in the kernel auditctl -l # Show audit daemon configuration cat /etc/audit/auditd.conf | grep -E "log_file|max_log_file|num_logs|space_left_action" # Check if the audit backlog is being exceeded (dropped events) auditctl -s ``` If the backlog limit is being reached, increase it: ```bash auditctl -b 8192 ``` ### Step 2: Deploy Intrusion-Focused Audit Rules Add rules that target common intrusion indicators. Place these in `/etc/audit/rules.d/intrusion.rules`: ```bash # Monitor credential files for unauthorized reads or modifications -w /etc/passwd -p wa -k credential_access -w /etc/shadow -p rwa -k credential_access -w /etc/gshadow -p rwa -k credential_access -w /etc/sudoers -p wa -k privilege_escalation -w /etc/sudoers.d/ -p wa -k privilege_escalation # Monitor SSH configuration and authorized keys -w /etc/ssh/sshd_config -p wa -k sshd_config_change -w /root/.ssh/authorized_keys -p wa -k ssh_key_tampering # Monitor user and group management commands -w /usr/sbin/useradd -p x -k user_management -w /usr/sbin/usermod -p x -k user_management -w /usr/sbin/groupadd -p x -k user_management # Detect process injection via ptrace -a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k process_injection -a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k process_injection -a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k process_injection # Monitor execution of programs from unusual directories -a always,exit -F arch=b64 -S execve -F exe=/tmp -k exec_from_tmp -a always,exit -F arch=b64 -S execve -F exe=/dev/shm -k exec_from_shm # Detect kernel module loading (rootkit installation) -a always,exit -F arch=b64 -S init_module -S finit_module -k kernel_module_load -a always,exit -F arch=b64 -S delete_module -k kernel_module_remove -w /sbin/insmod -p x -k kernel_module_tool -w /sbin/modprobe -p x -k kernel_module_tool # Monitor network socket creation for reverse shells -a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created -a always,exit -F arch=b64 -S connect -F a0=2 -k network_connection # Detect cron job modifications (persistence) -w /etc/crontab -p wa -k cron_persistence -w /etc/cron.d/ -p wa -k cron_persistence -w /var/spool/cron/ -p wa -k cron_persistence # Monitor log deletion or tampering -w /var/log/ -p wa -k log_tampering ``` Reload rules after editing: ```bash augenrules --load auditctl -l | wc -l # Confirm rule count ``` ### Step 3: Search for Intrusion Indicators with ausearch Use `ausearch` to query the audit log for specific events: ```bash # Search for all failed login attempts in the last 24 hours ausearch -m USER_LOGIN --success no -ts recent # Search for commands executed by a specific user ausearch -ua 1001 -m EXECVE -ts today # Search for all file access events on /etc/shadow ausearch -f /etc/shadow -ts this-week # Search for privilege escalation via sudo ausearch -m USER_CMD -ts today # Search for kernel module loading events ausearch -k kernel_module_load -ts this-month # Search for processes executed from /tmp (common attack staging) ausearch -k exec_from_tmp -ts this-week # Search for SSH key modifications ausearch -k ssh_key_tampering -ts this-month # Search for a specific event by audit event ID ausearch -a 12345 # Search events in a specific time range ausearch -ts 03/15/2026 08:00:00 -te 03/15/2026 18:00:00 # Interpret syscall numbers and format output readably ausearch -k credential_access -i -ts today ``` ### Step 4: Generate Summary Reports with aureport Use `aureport` to produce aggregate summaries for triage: ```bash # Summary of all authentication events aureport -au -ts this-week --summary # Report of all failed events (login, access, etc.) aureport --failed --summary -ts today # Report of executable runs aureport -x --summary -ts today # Report of all anomaly events (segfaults, promiscuous mode, etc.) aureport --anomaly -ts this-week # Report of file access events aureport -f --summary -ts today # Report of all events by key (maps to your custom rule keys) aureport -k --summary -ts this-month # Report of all system calls aureport -s --summary -ts today # Report of events grouped by user aureport -u --summary -ts this-week # Detailed time-based event report for timeline building aureport -ts 03/15/2026 08:00:00 -te 03/15/2026 18:00:00 --summary ``` ### Step 5: Reconstruct the Attack Timeline Combine ausearch queries to build a chronological narrative: ```bash # Step 5a: Identify the initial access timestamp ausearch -m USER_LOGIN -ua 0 --success yes -ts this-week -i | head -50 # Step 5b: Trace what the attack
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
Detect dangerous ACL misconfigurations in Active Directory using ldap3
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query