0

I'll tried to exclude event from cron jobs running that can be found with the KQL request : auditd.summary.how :"/usr/sbin/cron"

My host does not running SE Linux, so the rules i found (put bellow) does not work :

-a never,user -F subj_type=crond_t
-a exit,never -F subj_type=crond_t

I'll try this :

-a never,user -F exe=/usr/sbin/cron

Not working too.

Thanks for help.

Inazo
  • 101
  • 1

1 Answers1

0

So after more searched i'll found this it works fine :

- module: auditd
  # Load audit rules from separate files. Same format as audit.rules(7).
  audit_rule_files: [ '${path.config}/audit.rules.d/*.conf' ]
  audit_rules: |
    ## Define audit rules here.
    ## Create file watches (-w) or syscall audits (-a or -A). Uncomment these
    ## examples or add your own rules.

    ## If you are on a 64 bit platform, everything should be running
    ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls
    ## because this might be a sign of someone exploiting a hole in the 32
    ## bit API.
    #-a always,exit -F arch=b32 -S all -F key=32bit-abi

    ## Executions.
    #-a always,exit -F arch=b64 -S execve,execveat -k exec

    ## External access (warning: these can be expensive to audit).
    #-a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access

    ## Identity changes.
    -w /etc/group -p wa -k identity
    -w /etc/passwd -p wa -k identity
    -w /etc/gshadow -p wa -k identity

    ## Unauthorized access attempts.
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access

  processors:
    - drop_event:
        when:
          equals:
            process.executable: "/usr/sbin/cron"

The interessant part are:

processors:
        - drop_event:
            when:
              equals:
                process.executable: "/usr/sbin/cron"

I'll asked to auditbeat to drop the event when it run by process "/usr/sbin/cron"

Inazo
  • 101
  • 1