|
Server : Apache System : Linux vps-1289444.devslamantis.cl 3.10.0-1160.139.1.el7.tuxcare.els2.x86_64 #1 SMP Mon Nov 3 13:30:41 UTC 2025 x86_64 User : vspt ( 1013) PHP Version : 7.4.33 Disable Function : NONE Directory : /usr/share/doc/audit-2.8.5/rules/ |
## These rules watch for code injection by the ptrace facility. ## This could indicate someone trying to do something bad or ## just debugging #-a always,exit -F arch=b32 -S ptrace -F key=tracing -a always,exit -F arch=b64 -S ptrace -F key=tracing -a always,exit -F arch=b32 -S ptrace -F a0=0x4 -F key=code-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x4 -F key=code-injection -a always,exit -F arch=b32 -S ptrace -F a0=0x5 -F key=data-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x5 -F key=data-injection -a always,exit -F arch=b32 -S ptrace -F a0=0x6 -F key=register-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x6 -F key=register-injection