Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work?

When an application gets executed do all the specified syscalls have to be executed within a short time period of each other or at the same time or just be in the application?

If I wanted to fine tune my auditd rules to look for exploits, would I specify all the syscalls listed in the exploit?


You must log in to answer this question.

Browse other questions tagged .