auditd

TUI for viewing logs from journald, auditd, file system, Docker and Podman containers, Compose stacks and Kubernetes pods with support for log highlighting and several filtering modes.

Transform Linux Audit logs for SIEM usage

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

A Linux Auditd rule set mapped to MITRE's Attack Framework

Ansible role to apply a security baseline. Systemd edition.

Hands-on projects for beginners to learn and practice essential cybersecurity skills through security assessments.

go-libaudit is a library for communicating with the Linux Audit Framework.

ArchLinux setup which focuses on desktop security

A library and a tool for converting audit logs to XML and JSON

Hardening the Linux operating system for Debian like distributions.

Install and configure user mode auditd tools

!!!不建议使用了，可以使用AuditBeat!!! Linux服务器命令监控辅助脚本，ElasticSearch + Logstash + Kibana + Redis + Auditd

🛡️ VPS-SECURE is the only script that turns a bare VPS into an operational fortress — honeypot, collaborative IPS, real-time dashboard, Telegram alerts — in 15 minutes and 1 command, with zero Linux expertise required. 🚀⚡

Curated Linux LPE corpus — 28 modules from 2016 to 2026, with detection rules. One command, safest-first root: skeletonkey --auto --i-know

Proof-of-Concept to evade auditd by writing /proc/PID/mem

Demo for Elastic's Auditbeat and SIEM

Install and configure auditd on your system.

Best practice configuration for Linux auditd for CIS and STIG standards, enhanced with LOTL detection rules. If you need help with implementation, contact@criticalmissions.be

Proof-of-Concept to evade auditd by tampering via ptrace

CopyFail (CVE-2026-31431): Linux kernel page-cache PrivEsc PoC + the only public detection tool. Novel PAM auth-bypass vector + Sigma/auditd/eBPF rules.