From b879ae69951708cb7feada82e62f85b62f24cf89 Mon Sep 17 00:00:00 2001
From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com>
Date: Mon, 2 Nov 2026 13:47:13 +0330
Subject: [PATCH] Add Linux auditd audit config modification dataset
 (T1562.001)

Auditd PATH+SYSCALL+PROCTITLE records of an attacker modifying an audit
rules file under /etc/audit/rules.d/ on an authorized lab host - a sed
editor rewrite (rename -> PATH CREATE, comm=sed) and a tee in-place
append (PATH NORMAL, comm=tee), key=auditconfig. For the Linux Auditd
Audit Configuration File Modification detection.
---
 .../linux_auditd_audit_config_modification.log                 | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 datasets/attack_techniques/T1562.001/linux_auditd_audit_config_modification/linux_auditd_audit_config_modification.log

diff --git a/datasets/attack_techniques/T1562.001/linux_auditd_audit_config_modification/linux_auditd_audit_config_modification.log b/datasets/attack_techniques/T1562.001/linux_auditd_audit_config_modification/linux_auditd_audit_config_modification.log
new file mode 100644
index 00000000..b457bed9
--- /dev/null
+++ b/datasets/attack_techniques/T1562.001/linux_auditd_audit_config_modification/linux_auditd_audit_config_modification.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:31ba4879e2bde81ab2b50938a59fd114c5e60cdae6da11cc53c9f69c72e35610
+size 2625