Logging Configuration Changes on Linux Host

Title: Logging Configuration Changes on Linux Host
Status: test
Description:Detect changes of syslog daemons configuration files
References:
  -self experience
Author: Mikhail Larin, oscd.community
Date: 2019-10-25
modified:2021-11-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'PATH'
    name:
      -'/etc/syslog.conf'
      -'/etc/rsyslog.conf'
      -'/etc/syslog-ng/syslog-ng.conf'

  condition:selection
Falsepositives:
  -Legitimate administrative activity
Level: high