Auditing Configuration Changes on Linux Host — Detection Rule

Detect changes in auditd configuration files

Read the full analysis on IntelFusions