[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESMC5QHC7MNPMKWBMCT6MS":3,"skill-same:01M6ESMC5QHC7MNPMKWBMCT6MS":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":14,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6ESMC5QHC7MNPMKWBMCT6MS","analyzing-linux-audit-logs-for-intrusion",null,"Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-audit-logs-for-intrusion\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"linux","audit","logs","analyzing","analyzing linux audit logs for intrusion","audit log","suspicious","host","incident","log","access","analysis","HIDS","intrusion-detection","linux-security","aureport","ausearch","auditd","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-linux-audit-logs-for-intrusion\ndescription: 'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities\n  to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious\n  system activity. Covers audit rule configuration, log querying, timeline reconstruction,\n  and integration with SIEM platforms. Activates for requests involving auditd analysis,\n  Linux audit log investigation, ausearch queries, aureport summaries, or host-based\n  intrusion detection on Linux.\n\n  '\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- auditd\n- ausearch\n- aureport\n- linux-security\n- intrusion-detection\n- HIDS\n- forensics\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\nmitre_attack:\n- T1059.004\n- T1070\n- T1548.003\n- T1543.002\n---\n\n# Analyzing Linux Audit Logs for Intrusion\n\n## When to Use\n\n- Investigating suspected unauthorized access or privilege escalation on Linux hosts\n- Hunting for evidence of exploitation, backdoor installation, or persistence mechanisms\n- Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring\n- Reconstructing a timeline of attacker actions during incident response\n- Detecting file tampering on critical system files such as `\u002Fetc\u002Fpasswd`, `\u002Fetc\u002Fshadow`, or SSH keys\n\n**Do not use** for network-level intrusion detection; use Suricata or Zeek for network traffic analysis. Auditd operates at the kernel level on individual hosts.\n\n## Prerequisites\n\n- Linux system with `auditd` package installed and the audit daemon running (`systemctl status auditd`)\n- Root or sudo access to configure audit rules and query logs\n- Audit rules deployed via `\u002Fetc\u002Faudit\u002Frules.d\u002F*.rules` or loaded with `auditctl`\n- Recommended: Neo23x0\u002Fauditd ruleset from GitHub for comprehensive baseline coverage\n- Familiarity with Linux syscalls (`execve`, `open`, `connect`, `ptrace`, etc.)\n- Log storage with sufficient retention (default location: `\u002Fvar\u002Flog\u002Faudit\u002Faudit.log`)\n\n## Workflow\n\n### Step 1: Verify Audit Daemon Status and Configuration\n\nConfirm the audit system is running and check the current rule set:\n\n```bash\n# Check auditd service status\nsystemctl status auditd\n\n# Show current audit rules loaded in the kernel\nauditctl -l\n\n# Show audit daemon configuration\ncat \u002Fetc\u002Faudit\u002Fauditd.conf | grep -E \"log_file|max_log_file|num_logs|space_left_action\"\n\n# Check if the audit backlog is being exceeded (dropped events)\nauditctl -s\n```\n\nIf the backlog limit is being reached, increase it:\n\n```bash\nauditctl -b 8192\n```\n\n### Step 2: Deploy Intrusion-Focused Audit Rules\n\nAdd rules that target common intrusion indicators. Place these in `\u002Fetc\u002Faudit\u002Frules.d\u002Fintrusion.rules`:\n\n```bash\n# Monitor credential files for unauthorized reads or modifications\n-w \u002Fetc\u002Fpasswd -p wa -k credential_access\n-w \u002Fetc\u002Fshadow -p rwa -k credential_access\n-w \u002Fetc\u002Fgshadow -p rwa -k credential_access\n-w \u002Fetc\u002Fsudoers -p wa -k privilege_escalation\n-w \u002Fetc\u002Fsudoers.d\u002F -p wa -k privilege_escalation\n\n# Monitor SSH configuration and authorized keys\n-w \u002Fetc\u002Fssh\u002Fsshd_config -p wa -k sshd_config_change\n-w \u002Froot\u002F.ssh\u002Fauthorized_keys -p wa -k ssh_key_tampering\n\n# Monitor user and group management commands\n-w \u002Fusr\u002Fsbin\u002Fuseradd -p x -k user_management\n-w \u002Fusr\u002Fsbin\u002Fusermod -p x -k user_management\n-w \u002Fusr\u002Fsbin\u002Fgroupadd -p x -k user_management\n\n# Detect process injection via ptrace\n-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k process_injection\n-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k process_injection\n-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k process_injection\n\n# Monitor execution of programs from unusual directories\n-a always,exit -F arch=b64 -S execve -F exe=\u002Ftmp -k exec_from_tmp\n-a always,exit -F arch=b64 -S execve -F exe=\u002Fdev\u002Fshm -k exec_from_shm\n\n# Detect kernel module loading (rootkit installation)\n-a always,exit -F arch=b64 -S init_module -S finit_module -k kernel_module_load\n-a always,exit -F arch=b64 -S delete_module -k kernel_module_remove\n-w \u002Fsbin\u002Finsmod -p x -k kernel_module_tool\n-w \u002Fsbin\u002Fmodprobe -p x -k kernel_module_tool\n\n# Monitor network socket creation for reverse shells\n-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created\n-a always,exit -F arch=b64 -S connect -F a0=2 -k network_connection\n\n# Detect cron job modifications (persistence)\n-w \u002Fetc\u002Fcrontab -p wa -k cron_persistence\n-w \u002Fetc\u002Fcron.d\u002F -p wa -k cron_persistence\n-w \u002Fvar\u002Fspool\u002Fcron\u002F -p wa -k cron_persistence\n\n# Monitor log deletion or tampering\n-w \u002Fvar\u002Flog\u002F -p wa -k log_tampering\n```\n\nReload rules after editing:\n\n```bash\naugenrules --load\nauditctl -l | wc -l   # Confirm rule count\n```\n\n### Step 3: Search for Intrusion Indicators with ausearch\n\nUse `ausearch` to query the audit log for specific events:\n\n```bash\n# Search for all failed login attempts in the last 24 hours\nausearch -m USER_LOGIN --success no -ts recent\n\n# Search for commands executed by a specific user\nausearch -ua 1001 -m EXECVE -ts today\n\n# Search for all file access events on \u002Fetc\u002Fshadow\nausearch -f \u002Fetc\u002Fshadow -ts this-week\n\n# Search for privilege escalation via sudo\nausearch -m USER_CMD -ts today\n\n# Search for kernel module loading events\nausearch -k kernel_module_load -ts this-month\n\n# Search for processes executed from \u002Ftmp (common attack staging)\nausearch -k exec_from_tmp -ts this-week\n\n# Search for SSH key modifications\nausearch -k ssh_key_tampering -ts this-month\n\n# Search for a specific event by audit event ID\nausearch -a 12345\n\n# Search events in a specific time range\nausearch -ts 03\u002F15\u002F2026 08:00:00 -te 03\u002F15\u002F2026 18:00:00\n\n# Interpret syscall numbers and format output readably\nausearch -k credential_access -i -ts today\n```\n\n### Step 4: Generate Summary Reports with aureport\n\nUse `aureport` to produce aggregate summaries for triage:\n\n```bash\n# Summary of all authentication events\naureport -au -ts this-week --summary\n\n# Report of all failed events (login, access, etc.)\naureport --failed --summary -ts today\n\n# Report of executable runs\naureport -x --summary -ts today\n\n# Report of all anomaly events (segfaults, promiscuous mode, etc.)\naureport --anomaly -ts this-week\n\n# Report of file access events\naureport -f --summary -ts today\n\n# Report of all events by key (maps to your custom rule keys)\naureport -k --summary -ts this-month\n\n# Report of all system calls\naureport -s --summary -ts today\n\n# Report of events grouped by user\naureport -u --summary -ts this-week\n\n# Detailed time-based event report for timeline building\naureport -ts 03\u002F15\u002F2026 08:00:00 -te 03\u002F15\u002F2026 18:00:00 --summary\n```\n\n### Step 5: Reconstruct the Attack Timeline\n\nCombine ausearch queries to build a chronological narrative:\n\n```bash\n# Step 5a: Identify the initial access timestamp\nausearch -m USER_LOGIN -ua 0 --success yes -ts this-week -i | head -50\n\n# Step 5b: Trace what the attacker did after gaining access\n# Get all events from the compromised account within the incident window\nausearch -ua \u003CUID> -ts \"03\u002F15\u002F2026 14:00:00\" -te \"03\u002F15\u002F2026 18:00:00\" -i \\\n  | aureport -f -i\n\n# Step 5c: Extract all commands executed during the incident window\nausearch -m EXECVE -ts \"03\u002F15\u002F2026 14:00:00\" -te \"03\u002F15\u002F2026 18:00:00\" -i\n\n# Step 5d: Check for persistence mechanisms installed\nausearch -k cron_persistence -ts \"03\u002F15\u002F2026 14:00:00\" -i\nausearch -k ssh_key_tampering -ts \"03\u002F15\u002F2026 14:00:00\" -i\n\n# Step 5e: Check for lateral movement (outbound connections)\nausearch -k network_connection -ts \"03\u002F15\u002F2026 14:00:00\" -i\n```\n\n### Step 6: Forward Audit Logs to SIEM\n\nConfigure `audisp-remote` or `auditbeat` to ship logs to a central SIEM for correlation:\n\n```bash\n# Option A: Using audisp-remote plugin\n# Edit \u002Fetc\u002Faudit\u002Fplugins.d\u002Fau-remote.conf\nactive = yes\ndirection = out\npath = \u002Fsbin\u002Faudisp-remote\ntype = always\n\n# Configure remote target in \u002Fetc\u002Faudit\u002Faudisp-remote.conf\nremote_server = siem.internal.corp\nport = 6514\ntransport = tcp\n\n# Option B: Using Elastic Auditbeat\n# Install auditbeat and configure \u002Fetc\u002Fauditbeat\u002Fauditbeat.yml\n# Auditbeat reads directly from the kernel audit framework\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **auditd** | The Linux Audit daemon that receives audit events from the kernel and writes them to `\u002Fvar\u002Flog\u002Faudit\u002Faudit.log` |\n| **auditctl** | Command-line utility to control the audit system: add\u002Fremove rules, check status, set backlog size |\n| **ausearch** | Query tool that searches audit logs by message type, user, file, key, time range, or event ID |\n| **aureport** | Reporting tool that generates aggregate summaries of audit events for triage and compliance |\n| **audit rule key (-k)** | A user-defined label attached to an audit rule, enabling fast filtering of related events with ausearch and aureport |\n| **syscall auditing** | Kernel-level monitoring of system calls (execve, open, connect, ptrace) that captures process and file activity |\n| **augenrules** | Utility that merges all files in `\u002Fetc\u002Faudit\u002Frules.d\u002F` into `\u002Fetc\u002Faudit\u002Faudit.rules` and loads them into the kernel |\n\n## Verification\n\n- [ ] auditd is running and rules are loaded (`auditctl -l` returns expected rule count)\n- [ ] No audit backlog overflow (`auditctl -s` shows `backlog: 0` or low value, lost: 0)\n- [ ] ausearch returns events for each custom key (`ausearch -k \u003Ckey> -ts today` returns results)\n- [ ] aureport generates non-empty summaries for authentication, executable, and file events\n- [ ] Timeline reconstruction produces a coherent chronological sequence of attacker actions\n- [ ] Critical file watches trigger alerts on test modifications (`touch \u002Fetc\u002Fshadow` generates an event)\n- [ ] Logs are forwarding to central SIEM (verify with a test event and confirm receipt)\n- [ ] Audit rules persist across reboot (rules in `\u002Fetc\u002Faudit\u002Frules.d\u002F`, not only via `auditctl`)\n","# Analyzing Linux Audit Logs for Intrusion\n\n## When to Use\n\n- Investigating suspected unauthorized access or privilege escalation on Linux hosts\n- Hunting for evidence of exploitation, backdoor installation, or persistence mechanisms\n- Auditing compliance with security baselines (CIS, STIG, PCI-DSS) that require system call monitoring\n- Reconstructing a timeline of attacker actions during incident response\n- Detecting file tampering on critical system files such as `\u002Fetc\u002Fpasswd`, `\u002Fetc\u002Fshadow`, or SSH keys\n\n**Do not use** for network-level intrusion detection; use Suricata or Zeek for network traffic analysis. Auditd operates at the kernel level on individual hosts.\n\n## Prerequisites\n\n- Linux system with `auditd` package installed and the audit daemon running (`systemctl status auditd`)\n- Root or sudo access to configure audit rules and query logs\n- Audit rules deployed via `\u002Fetc\u002Faudit\u002Frules.d\u002F*.rules` or loaded with `auditctl`\n- Recommended: Neo23x0\u002Fauditd ruleset from GitHub for comprehensive baseline coverage\n- Familiarity with Linux syscalls (`execve`, `open`, `connect`, `ptrace`, etc.)\n- Log storage with sufficient retention (default location: `\u002Fvar\u002Flog\u002Faudit\u002Faudit.log`)\n\n## Workflow\n\n### Step 1: Verify Audit Daemon Status and Configuration\n\nConfirm the audit system is running and check the current rule set:\n\n```bash\n# Check auditd service status\nsystemctl status auditd\n\n# Show current audit rules loaded in the kernel\nauditctl -l\n\n# Show audit daemon configuration\ncat \u002Fetc\u002Faudit\u002Fauditd.conf | grep -E \"log_file|max_log_file|num_logs|space_left_action\"\n\n# Check if the audit backlog is being exceeded (dropped events)\nauditctl -s\n```\n\nIf the backlog limit is being reached, increase it:\n\n```bash\nauditctl -b 8192\n```\n\n### Step 2: Deploy Intrusion-Focused Audit Rules\n\nAdd rules that target common intrusion indicators. Place these in `\u002Fetc\u002Faudit\u002Frules.d\u002Fintrusion.rules`:\n\n```bash\n# Monitor credential files for unauthorized reads or modifications\n-w \u002Fetc\u002Fpasswd -p wa -k credential_access\n-w \u002Fetc\u002Fshadow -p rwa -k credential_access\n-w \u002Fetc\u002Fgshadow -p rwa -k credential_access\n-w \u002Fetc\u002Fsudoers -p wa -k privilege_escalation\n-w \u002Fetc\u002Fsudoers.d\u002F -p wa -k privilege_escalation\n\n# Monitor SSH configuration and authorized keys\n-w \u002Fetc\u002Fssh\u002Fsshd_config -p wa -k sshd_config_change\n-w \u002Froot\u002F.ssh\u002Fauthorized_keys -p wa -k ssh_key_tampering\n\n# Monitor user and group management commands\n-w \u002Fusr\u002Fsbin\u002Fuseradd -p x -k user_management\n-w \u002Fusr\u002Fsbin\u002Fusermod -p x -k user_management\n-w \u002Fusr\u002Fsbin\u002Fgroupadd -p x -k user_management\n\n# Detect process injection via ptrace\n-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k process_injection\n-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k process_injection\n-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k process_injection\n\n# Monitor execution of programs from unusual directories\n-a always,exit -F arch=b64 -S execve -F exe=\u002Ftmp -k exec_from_tmp\n-a always,exit -F arch=b64 -S execve -F exe=\u002Fdev\u002Fshm -k exec_from_shm\n\n# Detect kernel module loading (rootkit installation)\n-a always,exit -F arch=b64 -S init_module -S finit_module -k kernel_module_load\n-a always,exit -F arch=b64 -S delete_module -k kernel_module_remove\n-w \u002Fsbin\u002Finsmod -p x -k kernel_module_tool\n-w \u002Fsbin\u002Fmodprobe -p x -k kernel_module_tool\n\n# Monitor network socket creation for reverse shells\n-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created\n-a always,exit -F arch=b64 -S connect -F a0=2 -k network_connection\n\n# Detect cron job modifications (persistence)\n-w \u002Fetc\u002Fcrontab -p wa -k cron_persistence\n-w \u002Fetc\u002Fcron.d\u002F -p wa -k cron_persistence\n-w \u002Fvar\u002Fspool\u002Fcron\u002F -p wa -k cron_persistence\n\n# Monitor log deletion or tampering\n-w \u002Fvar\u002Flog\u002F -p wa -k log_tampering\n```\n\nReload rules after editing:\n\n```bash\naugenrules --load\nauditctl -l | wc -l   # Confirm rule count\n```\n\n### Step 3: Search for Intrusion Indicators with ausearch\n\nUse `ausearch` to query the audit log for specific events:\n\n```bash\n# Search for all failed login attempts in the last 24 hours\nausearch -m USER_LOGIN --success no -ts recent\n\n# Search for commands executed by a specific user\nausearch -ua 1001 -m EXECVE -ts today\n\n# Search for all file access events on \u002Fetc\u002Fshadow\nausearch -f \u002Fetc\u002Fshadow -ts this-week\n\n# Search for privilege escalation via sudo\nausearch -m USER_CMD -ts today\n\n# Search for kernel module loading events\nausearch -k kernel_module_load -ts this-month\n\n# Search for processes executed from \u002Ftmp (common attack staging)\nausearch -k exec_from_tmp -ts this-week\n\n# Search for SSH key modifications\nausearch -k ssh_key_tampering -ts this-month\n\n# Search for a specific event by audit event ID\nausearch -a 12345\n\n# Search events in a specific time range\nausearch -ts 03\u002F15\u002F2026 08:00:00 -te 03\u002F15\u002F2026 18:00:00\n\n# Interpret syscall numbers and format output readably\nausearch -k credential_access -i -ts today\n```\n\n### Step 4: Generate Summary Reports with aureport\n\nUse `aureport` to produce aggregate summaries for triage:\n\n```bash\n# Summary of all authentication events\naureport -au -ts this-week --summary\n\n# Report of all failed events (login, access, etc.)\naureport --failed --summary -ts today\n\n# Report of executable runs\naureport -x --summary -ts today\n\n# Report of all anomaly events (segfaults, promiscuous mode, etc.)\naureport --anomaly -ts this-week\n\n# Report of file access events\naureport -f --summary -ts today\n\n# Report of all events by key (maps to your custom rule keys)\naureport -k --summary -ts this-month\n\n# Report of all system calls\naureport -s --summary -ts today\n\n# Report of events grouped by user\naureport -u --summary -ts this-week\n\n# Detailed time-based event report for timeline building\naureport -ts 03\u002F15\u002F2026 08:00:00 -te 03\u002F15\u002F2026 18:00:00 --summary\n```\n\n### Step 5: Reconstruct the Attack Timeline\n\nCombine ausearch queries to build a chronological narrative:\n\n```bash\n# Step 5a: Identify the initial access timestamp\nausearch -m USER_LOGIN -ua 0 --success yes -ts this-week -i | head -50\n\n# Step 5b: Trace what the attacker did after gaining access\n# Get all events from the compromised account within the incident window\nausearch -ua \u003CUID> -ts \"03\u002F15\u002F2026 14:00:00\" -te \"03\u002F15\u002F2026 18:00:00\" -i \\\n  | aureport -f -i\n\n# Step 5c: Extract all commands executed during the incident window\nausearch -m EXECVE -ts \"03\u002F15\u002F2026 14:00:00\" -te \"03\u002F15\u002F2026 18:00:00\" -i\n\n# Step 5d: Check for persistence mechanisms installed\nausearch -k cron_persistence -ts \"03\u002F15\u002F2026 14:00:00\" -i\nausearch -k ssh_key_tampering -ts \"03\u002F15\u002F2026 14:00:00\" -i\n\n# Step 5e: Check for lateral movement (outbound connections)\nausearch -k network_connection -ts \"03\u002F15\u002F2026 14:00:00\" -i\n```\n\n### Step 6: Forward Audit Logs to SIEM\n\nConfigure `audisp-remote` or `auditbeat` to ship logs to a central SIEM for correlation:\n\n```bash\n# Option A: Using audisp-remote plugin\n# Edit \u002Fetc\u002Faudit\u002Fplugins.d\u002Fau-remote.conf\nactive = yes\ndirection = out\npath = \u002Fsbin\u002Faudisp-remote\ntype = always\n\n# Configure remote target in \u002Fetc\u002Faudit\u002Faudisp-remote.conf\nremote_server = siem.internal.corp\nport = 6514\ntransport = tcp\n\n# Option B: Using Elastic Auditbeat\n# Install auditbeat and configure \u002Fetc\u002Fauditbeat\u002Fauditbeat.yml\n# Auditbeat reads directly from the kernel audit framework\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **auditd** | The Linux Audit daemon that receives audit events from the kernel and writes them to `\u002Fvar\u002Flog\u002Faudit\u002Faudit.log` |\n| **auditctl** | Command-line utility to control the audit system: add\u002Fremove rules, check status, set backlog size |\n| **ausearch** | Query tool that searches audit logs by message type, user, file, key, time range, or event ID |\n| **aureport** | Reporting tool that generates aggregate summaries of audit events for triage and compliance |\n| **audit rule key (-k)** | A user-defined label attached to an audit rule, enabling fast filtering of related events with ausearch and aureport |\n| **syscall auditing** | Kernel-level monitoring of system calls (execve, open, connect, ptrace) that captures process and file activity |\n| **augenrules** | Utility that merges all files in `\u002Fetc\u002Faudit\u002Frules.d\u002F` into `\u002Fetc\u002Faudit\u002Faudit.rules` and loads them into the kernel |\n\n## Verification\n\n- [ ] auditd is running and rules are loaded (`auditctl -l` returns expected rule count)\n- [ ] No audit backlog overflow (`auditctl -s` shows `backlog: 0` or low value, lost: 0)\n- [ ] ausearch returns events for each custom key (`ausearch -k \u003Ckey> -ts today` returns results)\n- [ ] aureport generates non-empty summaries for authentication, executable, and file events\n- [ ] Timeline reconstruction produces a coherent chronological sequence of attacker actions\n- [ ] Critical file watches trigger alerts on test modifications (`touch \u002Fetc\u002Fshadow` generates an event)\n- [ ] Logs are forwarding to central SIEM (verify with a test event and confirm receipt)\n- [ ] Audit rules persist across reboot (rules in `\u002Fetc\u002Faudit\u002Frules.d\u002F`, not only via `auditctl`)\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":59,"mitre_attack":60},[41,40,39,38,37,36,50],"forensics","mahipal","1.0.0",[54,55,56,57],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response","Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.\n",[61,62,63,64],"T1059.004","T1070","T1548.003","T1543.002","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-linux-audit-logs-for-intrusion","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-linux-audit-logs-for-intrusion",{"tool":79,"command":80},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-linux-audit-logs-for-intrusion",{"tool":82,"command":83},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-linux-audit-logs-for-intrusion","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-audit-logs-for-intrusion\u002FSKILL.md",true,[87,92,98,102,106],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-audit-logs-for-intrusion\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",1911,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-audit-logs-for-intrusion\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fbatching-categories.md",5971,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T140243Z\u002Fsource\u002Fskills\u002Freact18-batching-patterns\u002Freferences\u002Fbatching-categories.md",{"path":103,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002FflushSync-guide.md",2469,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T140243Z\u002Fsource\u002Fskills\u002Freact18-batching-patterns\u002Freferences\u002FflushSync-guide.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",8103,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-audit-logs-for-intrusion\u002Fscripts\u002Fagent.py",[113,154,163,172,194,219],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":134,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[120,123,126,129],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":155,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],{"skillNo":164,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[167,168,169,170],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[179,180,181,182,183,184,185,186,187,188,189,190,191,192,193],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[200],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[202,203,204,205,206,207,35,208,209,210,211,146,147,212,213,214,215,216,217,218],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":235,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[225,228,231,232],{"categoryNo":226,"categoryName":227,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":229,"categoryName":230,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":233,"categoryName":234,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000036","内容创作者",[236,237,238,239,240,241,242,243,143,34,146,147,148,244,245,246,247,248,193,249],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]