Catching Linux Post-Exploitation with Auditd

Explore Linux post-exploitation detection using Auditd in this 22-minute conference talk from BSidesLV 2015. Delve into the motivations behind Auditd, its background, and key components such as system calls and audit rules. Learn about example configurations, file watch roles, and reporting examples. Examine an attack scenario, including setup, execve results, false positives, and post-behavior solutions. Gain insights into effective Linux security monitoring and threat detection techniques.

Intro
Why Auditd
Motivation
Background
Outline
System Calls
Julia Evans zine
Open call
Addie
Addie History
Oddity
Audit Rules
Example Configuration
File Watch Role
Reporting Example
Attack Scenario
Attack Setup
execve
results
false positives
post behavior
solutions
questions