Mister Spy Say ="Hello Kids ... :D" ___ ____ _ _____ | \/ (_) | | / ___| | . . |_ ___| |_ ___ _ __ \ `--. _ __ _ _ | |\/| | / __| __/ _ \ '__| `--. \ '_ \| | | | | | | | \__ \ || __/ | /\__/ / |_) | |_| | \_| |_/_|___/\__\___|_| \____/| .__/ \__, | | | __/ | |_| |___/ Bot Mister Spy V3
| Current Path : /usr/share/audit/sample-rules/ |
| Current File : //usr/share/audit/sample-rules/42-injection.rules |
## These rules watch for code injection by the ptrace facility. ## This could indicate someone trying to do something bad or ## just debugging #-a always,exit -F arch=b32 -S ptrace -F key=tracing -a always,exit -F arch=b64 -S ptrace -F key=tracing -a always,exit -F arch=b32 -S ptrace -F a0=0x4 -F key=code-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x4 -F key=code-injection -a always,exit -F arch=b32 -S ptrace -F a0=0x5 -F key=data-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x5 -F key=data-injection -a always,exit -F arch=b32 -S ptrace -F a0=0x6 -F key=register-injection -a always,exit -F arch=b64 -S ptrace -F a0=0x6 -F key=register-injection