Skip to content

Commit

Permalink
Update audit.rules uncompress
Browse files Browse the repository at this point in the history
  • Loading branch information
@Pierre-Gronau-ndaal
Pierre-Gronau-ndaal authored Feb 21, 2024
1 parent 36a7c52 commit abee6c9
Showing 1 changed file with 11 additions and 0 deletions.
11 changes: 11 additions & 0 deletions audit.rules
View file
Original file line number Diff line number Diff line change
Expand Up @@ -413,6 +413,17 @@
-w /usr/bin/zstd -p x -k Data_Compressed
-w /usr/local/bin/zstd -p x -k Data_Compressed

## uncompress
-a always,exit -F arch=b32 -F path=/usr/bin/uncompress -F perm=x -F key=Data_Compressed
-a always,exit -F arch=b64 -F path=/usr/bin/uncompress -F perm=x -F key=Data_Compressed

-a always,exit -F arch=b32 -F path=/usr/sbin/uncompress -F perm=x -F key=Data_Compressed
-a always,exit -F arch=b64 -F path=/usr/sbin/uncompress -F perm=x -F key=Data_Compressed

### macOS
-a always,exit -F arch=b32 -F path=/usr/local/bin/uncompress -F perm=x -F key=Data_Compressed
-a always,exit -F arch=b64 -F path=/usr/local/bin/uncompress -F perm=x -F key=Data_Compressed

## Added to catch netcat on Ubuntu
-w /bin/nc.openbsd -p x -k susp_activity
-w /bin/nc.traditional -p x -k susp_activity
Expand Down

0 comments on commit abee6c9

Please sign in to comment.