analyzing-linux-audit-logs-for-intrusion
Utilizes the Linux Audit framework to detect intrusion attempts and unauthorized access through log analysis and rule configuration.
Install this skill
or
0/100
Security score
The analyzing-linux-audit-logs-for-intrusion skill was audited on Oct 20, 2026 and we found 14 security issues across 3 threat categories, including 3 critical. Review the findings below before installing.
Categories Tested
Security Issues
critical line 44
Access to /etc/passwd
SourceSKILL.md
| 42 | - Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring |
| 43 | - Reconstructing a timeline of attacker actions during incident response |
| 44 | - Detecting file tampering on critical system files such as `/etc/passwd`, `/etc/shadow`, or SSH keys |
| 45 | |
| 46 | **Do not use** for network-level intrusion detection; use Suricata or Zeek for network traffic analysis. Auditd operates at the kernel level on individual hosts. |
high line 89
Access to /etc/passwd
SourceSKILL.md
| 87 | ```bash |
| 88 | # Monitor credential files for unauthorized reads or modifications |
| 89 | -w /etc/passwd -p wa -k credential_access |
| 90 | -w /etc/shadow -p rwa -k credential_access |
| 91 | -w /etc/gshadow -p rwa -k credential_access |
critical line 44
Access to /etc/shadow
SourceSKILL.md
| 42 | - Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring |
| 43 | - Reconstructing a timeline of attacker actions during incident response |
| 44 | - Detecting file tampering on critical system files such as `/etc/passwd`, `/etc/shadow`, or SSH keys |
| 45 | |
| 46 | **Do not use** for network-level intrusion detection; use Suricata or Zeek for network traffic analysis. Auditd operates at the kernel level on individual hosts. |
high line 90
Access to /etc/shadow
SourceSKILL.md
| 88 | # Monitor credential files for unauthorized reads or modifications |
| 89 | -w /etc/passwd -p wa -k credential_access |
| 90 | -w /etc/shadow -p rwa -k credential_access |
| 91 | -w /etc/gshadow -p rwa -k credential_access |
| 92 | -w /etc/sudoers -p wa -k privilege_escalation |
high line 150
Access to /etc/shadow
SourceSKILL.md
| 148 | ausearch -ua 1001 -m EXECVE -ts today |
| 149 | |
| 150 | # Search for all file access events on /etc/shadow |
| 151 | ausearch -f /etc/shadow -ts this-week |
| 152 |
high line 151
Access to /etc/shadow
SourceSKILL.md
| 149 | |
| 150 | # Search for all file access events on /etc/shadow |
| 151 | ausearch -f /etc/shadow -ts this-week |
| 152 | |
| 153 | # Search for privilege escalation via sudo |
critical line 273
Access to /etc/shadow
SourceSKILL.md
| 271 | - [ ] aureport generates non-empty summaries for authentication, executable, and file events |
| 272 | - [ ] Timeline reconstruction produces a coherent chronological sequence of attacker actions |
| 273 | - [ ] Critical file watches trigger alerts on test modifications (`touch /etc/shadow` generates an event) |
| 274 | - [ ] Logs are forwarding to central SIEM (verify with a test event and confirm receipt) |
| 275 | - [ ] Audit rules persist across reboot (rules in `/etc/audit/rules.d/`, not only via `auditctl`) |
high line 97
Access to SSH directory
SourceSKILL.md
| 95 | # Monitor SSH configuration and authorized keys |
| 96 | -w /etc/ssh/sshd_config -p wa -k sshd_config_change |
| 97 | -w /root/.ssh/authorized_keys -p wa -k ssh_key_tampering |
| 98 | |
| 99 | # Monitor user and group management commands |
medium line 55
Access to system logs
SourceSKILL.md
| 53 | - Recommended: Neo23x0/auditd ruleset from GitHub for comprehensive baseline coverage |
| 54 | - Familiarity with Linux syscalls (`execve`, `open`, `connect`, `ptrace`, etc.) |
| 55 | - Log storage with sufficient retention (default location: `/var/log/audit/audit.log`) |
| 56 | |
| 57 | ## Workflow |
low line 129
Access to system logs
SourceSKILL.md
| 127 | |
| 128 | # Monitor log deletion or tampering |
| 129 | -w /var/log/ -p wa -k log_tampering |
| 130 | ``` |
| 131 |
medium line 258
Access to system logs
SourceSKILL.md
| 256 | | Term | Definition | |
| 257 | |------|------------| |
| 258 | | **auditd** | The Linux Audit daemon that receives audit events from the kernel and writes them to `/var/log/audit/audit.log` | |
| 259 | | **auditctl** | Command-line utility to control the audit system: add/remove rules, check status, set backlog size | |
| 260 | | **ausearch** | Query tool that searches audit logs by message type, user, file, key, time range, or event ID | |
high line 119
Reverse shell reference
SourceSKILL.md
| 117 | -w /sbin/modprobe -p x -k kernel_module_tool |
| 118 | |
| 119 | # Monitor network socket creation for reverse shells |
| 120 | -a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created |
| 121 | -a always,exit -F arch=b64 -S connect -F a0=2 -k network_connection |
medium line 124
Crontab modification
SourceSKILL.md
| 122 | |
| 123 | # Detect cron job modifications (persistence) |
| 124 | -w /etc/crontab -p wa -k cron_persistence |
| 125 | -w /etc/cron.d/ -p wa -k cron_persistence |
| 126 | -w /var/spool/cron/ -p wa -k cron_persistence |
medium line 125
System cron directory access
SourceSKILL.md
| 123 | # Detect cron job modifications (persistence) |
| 124 | -w /etc/crontab -p wa -k cron_persistence |
| 125 | -w /etc/cron.d/ -p wa -k cron_persistence |
| 126 | -w /var/spool/cron/ -p wa -k cron_persistence |
| 127 |
Scanned on Oct 20, 2026
View Security DashboardGitHub Stars 34.8K
Rate this skill
Categorydevelopment
UpdatedNovember 4, 2026
mukul975/Anthropic-Cybersecurity-Skills