cyberstrikeus CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
Control 5.2.1.3 - Ensure auditing for processes that start prior to auditd is enabled (Automated)
Profile Applicability
- Level 2 - Server
- Level 2 - Workstation
Description
Configure grub2 so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.
Rationale
Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected.
Audit
Run the following command:
find /boot -type f -name 'grub.cfg' -exec grep -Ph -- '^\h*linux\b' {} + | grep -v 'audit=1'
Expected Output: Nothing should be returned.
Remediation
Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX:
Example:
GRUB_CMDLINE_LINUX="audit=1"
Run the following command to update the grub2 configuration:
update-grub
References
- NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12
Additional Information
This recommendation is designed around the grub2 bootloader, if another bootloader is in use in your environment enact equivalent settings.
CIS Controls
- v8 8.2 Collect Audit Logs - Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.
- v7 6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices.
MITRE ATT&CK Mappings
- Techniques: T1562, T1562.001
- Tactics: TA0005 (Defense Evasion)
- Mitigations: M1047 (Audit)
Benchmark
CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
Automation Status
Automated