Enterprise Cloud Security and Governance

Solution

In the below solution, we monitor all the system calls dealing with deletion activity:

Appropriate system call rule :-auditctl -a always,exit -S unlink -S unlinkat -F auid>=500 -F auid!=4294967295 -k delete

Let's look into what each of the options really means:

• -S: A system call.
• unlink and unlinkat: Two system calls associated with deletion.
• auid>=500: This states audit for users whose auid are greater than 500. In a Linux system, typically, when we add users, their user ID starts > 500.
• -k: This is the key that will be associated with the event. It makes it easy to search in logs.