v0.2.0

v0.2.0

This release establishes the new simplified baseline of the auditd ruleset.

v0.1.0 preserved the historic, broad pre-simplification baseline from the old master. v0.2.0 is the first release of the streamlined model now used on master.

Core Principle

The ruleset is now intentionally telemetry-first.

The goal of audit.rules is to collect broad, attributable, reusable host telemetry. It should not try to encode every suspicious binary, shell, admin tool, or attacker workflow directly in the audit layer. In other words: the audit ruleset is the sensor, not the detection engine.

Detection logic belongs downstream in Sigma rules, SIEM queries, Aurora Linux, or other analytics that can correlate context, reduce noise, and evolve faster than a static auditd config.

That shift makes the ruleset:

• simpler to understand and maintain
• more portable across Linux distributions and libaudit variants
• less brittle than long lists of hard-coded per-binary detections
• easier to validate in CI and test before deployment
• better suited as a common telemetry source for multiple downstream tools

What Changed

Simplified execution coverage

• Added generic process_creation coverage with execve and execveat for both arch=b32 and arch=b64.
• Removed many per-binary execution watches that duplicated the same telemetry and pushed narrow detection logic into the ruleset.

Broader reusable telemetry

• Added or retained broad coverage that downstream detections can build on more effectively:
  • writes to /bin, /usr, and /boot
  • socket creation
  • permission-denied access by system accounts and daemons
  • exploitation-oriented primitives such as ptrace, memfd_create, bpf, unshare, setns, process_vm_*, io_uring_setup, and userfaultfd
  • package manager and container configuration changes

Portability and correctness improvements

• Documented UID_MIN assumptions and normalized auid!=unset handling in interactive-user rules.
• Removed distro-specific time-daemon assumptions from the default time rules.
• Avoided less portable syscall names where libaudit compatibility was inconsistent.
• Kept -i enabled so optional distro-specific paths do not abort loading by default.

Validation and maintainability

• Added CI linting for rule syntax and structure.
• Added Ubuntu-based load validation for both a portable CI copy and a strict copy without -i.
• Improved documentation around validation, UID_MIN, and the new detection-agnostic design.

Coverage Summary

This release keeps broad coverage across:

• audit integrity and audit configuration
• noise filters and portability-oriented exclusions
• kernel, module, mount, swap, and time changes
• cron, identity stores, PAM, sudo, and login state
• network, firewall, startup, boot-path, library, SSH, systemd, and MAC policy changes
• failed access attempts, DAC changes, session files, and privilege-abuse heuristics
• exploitation-adjacent primitives and special syscalls
• package manager, container, and selected security-tooling configuration
• high-volume telemetry such as process creation, file deletion and access failures, socket creation, and 32-bit ABI usage

Notes

• v0.1.0 remains available as the preserved historic baseline.
• v0.2.0 is the recommended starting point if you want the simplified, maintainable, detection-agnostic ruleset.
• If you prefer strict pre-deployment validation, test a temporary copy with -i removed before rollout.