analyzing-linux-audit-logs-for-intrusion

分析 Linux 审计日志以检测入侵

适用场景

• 调查 Linux 主机上疑似未经授权的访问或权限提升
• 搜寻漏洞利用、后门安装或持久化机制的证据
• 审计是否符合要求进行系统调用监控的安全基线（CIS、STIG、PCI-DSS）
• 在事件响应期间重建攻击者操作的时间线
• 检测对关键系统文件（如 /etc/passwd、/etc/shadow 或 SSH 密钥）的文件篡改

请勿用于网络层入侵检测；网络流量分析请使用 Suricata 或 Zeek。Auditd 在单台主机上运行于内核层。

前置条件

• 已安装 auditd 软件包且审计守护进程正在运行的 Linux 系统（systemctl status auditd）
• 具备 root 或 sudo 权限以配置审计规则和查询日志
• 通过 /etc/audit/rules.d/*.rules 部署或使用 auditctl 加载的审计规则
• 推荐：使用 GitHub 上的 Neo23x0/auditd 规则集以获得全面的基线覆盖
• 熟悉 Linux 系统调用（execve、open、connect、ptrace 等）
• 具备足够保留期的日志存储（默认位置：/var/log/audit/audit.log）

工作流

步骤 1：验证审计守护进程状态与配置

确认审计系统正在运行并检查当前规则集：

# Check auditd service status
systemctl status auditd

# Show current audit rules loaded in the kernel
auditctl -l

# Show audit daemon configuration
cat /etc/audit/auditd.conf | grep -E "log_file|max_log_file|num_logs|space_left_action"

# Check if the audit backlog is being exceeded (dropped events)
auditctl -s

如果 backlog 限制即将达到，请增大该限制：

auditctl -b 8192

步骤 2：部署面向入侵检测的审计规则

添加针对常见入侵指标的规则。将这些规则放入 /etc/audit/rules.d/intrusion.rules：

# Monitor credential files for unauthorized reads or modifications
-w /etc/passwd -p wa -k credential_access
-w /etc/shadow -p rwa -k credential_access
-w /etc/gshadow -p rwa -k credential_access
-w /etc/sudoers -p wa -k privilege_escalation
-w /etc/sudoers.d/ -p wa -k privilege_escalation

# Monitor SSH configuration and authorized keys
-w /etc/ssh/sshd_config -p wa -k sshd_config_change
-w /root/.ssh/authorized_keys -p wa -k ssh_key_tampering

# Monitor user and group management commands
-w /usr/sbin/useradd -p x -k user_management
-w /usr/sbin/usermod -p x -k user_management
-w /usr/sbin/groupadd -p x -k user_management

# Detect process injection via ptrace
-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k process_injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k process_injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k process_injection

# Monitor execution of programs from unusual directories
-a always,exit -F arch=b64 -S execve -F exe=/tmp -k exec_from_tmp
-a always,exit -F arch=b64 -S execve -F exe=/dev/shm -k exec_from_shm

# Detect kernel module loading (rootkit installation)
-a always,exit -F arch=b64 -S init_module -S finit_module -k kernel_module_load
-a always,exit -F arch=b64 -S delete_module -k kernel_module_remove
-w /sbin/insmod -p x -k kernel_module_tool
-w /sbin/modprobe -p x -k kernel_module_tool

# Monitor network socket creation for reverse shells
-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created
-a always,exit -F arch=b64 -S connect -F a0=2 -k network_connection

# Detect cron job modifications (persistence)
-w /etc/crontab -p wa -k cron_persistence
-w /etc/cron.d/ -p wa -k cron_persistence
-w /var/spool/cron/ -p wa -k cron_persistence

# Monitor log deletion or tampering
-w /var/log/ -p wa -k log_tampering

编辑后重新加载规则：

augenrules --load
auditctl -l | wc -l   # Confirm rule count

步骤 3：使用 ausearch 搜索入侵指标

使用 ausearch 在审计日志中查询特定事件：

# Search for all failed login attempts in the last 24 hours
ausearch -m USER_LOGIN --success no -ts recent

# Search for commands executed by a specific user
ausearch -ua 1001 -m EXECVE -ts today

# Search for all file access events on /etc/shadow
ausearch -f /etc/shadow -ts this-week

# Search for privilege escalation via sudo
ausearch -m USER_CMD -ts today

# Search for kernel module loading events
ausearch -k kernel_module_load -ts this-month

# Search for processes executed from /tmp (common attack staging)
ausearch -k exec_from_tmp -ts this-week

# Search for SSH key modifications
ausearch -k ssh_key_tampering -ts this-month

# Search for a specific event by audit event ID
ausearch -a 12345

# Search events in a specific time range
ausearch -ts 03/15/2026 08:00:00 -te 03/15/2026 18:00:00

# Interpret syscall numbers and format output readably
ausearch -k credential_access -i -ts today

步骤 4：使用 aureport 生成摘要报告

使用 aureport 生成用于分类的汇总摘要：

# Summary of all authentication events
aureport -au -ts this-week --summary

# Report of all failed events (login, access, etc.)
aureport --failed --summary -ts today

# Report of executable runs
aureport -x --summary -ts today

# Report of all anomaly events (segfaults, promiscuous mode, etc.)
aureport --anomaly -ts this-week

# Report of file access events
aureport -f --summary -ts today

# Report of all events by key (maps to your custom rule keys)
aureport -k --summary -ts this-month

# Report of all system calls
aureport -s --summary -ts today

# Report of events grouped by user
aureport -u --summary -ts this-week

# Detailed time-based event report for timeline building
aureport -ts 03/15/2026 08:00:00 -te 03/15/2026 18:00:00 --summary

步骤 5：重建攻击时间线

组合 ausearch 查询以构建按时间顺序的叙述：

# Step 5a: Identify the initial access timestamp
ausearch -m USER_LOGIN -ua 0 --success yes -ts this-week -i | head -50

# Step 5b: Trace what the attacker did after gaining access
# Get all events from the compromised account within the incident window
ausearch -ua <UID> -ts "03/15/2026 14:00:00" -te "03/15/2026 18:00:00" -i \
  | aureport -f -i

# Step 5c: Extract all commands executed during the incident window
ausearch -m EXECVE -ts "03/15/2026 14:00:00" -te "03/15/2026 18:00:00" -i

# Step 5d: Check for persistence mechanisms installed
ausearch -k cron_persistence -ts "03/15/2026 14:00:00" -i
ausearch -k ssh_key_tampering -ts "03/15/2026 14:00:00" -i

# Step 5e: Check for lateral movement (outbound connections)
ausearch -k network_connection -ts "03/15/2026 14:00:00" -i

步骤 6：将审计日志转发至 SIEM

配置 audisp-remote 或 auditbeat 将日志发送至中央 SIEM 以进行关联分析：

# Option A: Using audisp-remote plugin
# Edit /etc/audit/plugins.d/au-remote.conf
active = yes
direction = out
path = /sbin/audisp-remote
type = always

# Configure remote target in /etc/audit/audisp-remote.conf
remote_server = siem.internal.corp
port = 6514
transport = tcp

# Option B: Using Elastic Auditbeat
# Install auditbeat and configure /etc/auditbeat/auditbeat.yml
# Auditbeat reads directly from the kernel audit framework

关键概念

术语	定义
auditd	Linux 审计守护进程，从内核接收审计事件并将其写入 /var/log/audit/audit.log
auditctl	用于控制审计系统的命令行工具：添加/删除规则、检查状态、设置 backlog 大小
ausearch	查询工具，可按消息类型、用户、文件、键、时间范围或事件 ID 搜索审计日志
aureport	报告工具，生成审计事件的汇总摘要，用于分类和合规
审计规则键（-k）	附加到审计规则的用户自定义标签，可使用 ausearch 和 aureport 快速过滤相关事件
系统调用审计	对系统调用（execve、open、connect、ptrace）的内核级监控，可捕获进程和文件活动
augenrules	将 /etc/audit/rules.d/ 中的所有文件合并到 /etc/audit/audit.rules 并加载到内核的工具

验证

• auditd 正在运行且规则已加载（auditctl -l 返回预期的规则数量）
• 无审计 backlog 溢出（auditctl -s 显示 backlog: 0 或较低值，lost: 0）
• ausearch 对每个自定义键都返回事件（ausearch -k <key> -ts today 返回结果）
• aureport 为认证、可执行文件和文件事件生成非空摘要
• 时间线重建生成连贯的攻击者操作时间顺序
• 关键文件监控在测试修改时触发告警（touch /etc/shadow 生成事件）
• 日志正在转发至中央 SIEM（用测试事件验证并确认收到）
• 审计规则在重启后仍然保留（规则位于 /etc/audit/rules.d/，而不仅通过 auditctl）