fix: privilege abuse rule

#143
Neo23x0 · Apr 21, 2024 · 57bd661 · 57bd661
1 parent 36a7c52
commit 57bd661
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/audit.rules b/audit.rules
@@ -513,7 +513,7 @@
 
 ## Privilege Abuse
 ### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir.
--a always,exit -F dir=/home -F auid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse
+-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse
 
 # Socket Creations
 # will catch both IPv4 and IPv6