Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
articles in the coming days. Detection Creation Lets start with something simple and use this rule to check for executions from the directory /tmp. This is a known directory for dropping payloads and executing them. While there are ways to restrict such as the following: # mount | egrep --color -w