# Ensure file deletion events by users are collected

Necessity: Monitoring file deletion events is critical for security forensics and detecting malicious activity. An attacker or rogue insider might delete critical system files, application data, or log files to disrupt services or cover their tracks. Without this auditing, it would be difficult or impossible to trace unauthorized file modifications and hold individuals accountable, significantly hindering incident response.

Auditing and Remediation: The audit script inspects the currently active kernel audit rules to verify that the specific rules for monitoring file deletion syscalls are loaded. The remediation script ensures these rules are made persistent by writing them to a configuration file under '/etc/audit/rules.d/' and then triggers a reload of all rules into the auditd service, ensuring the system actively monitors for these events across reboots.

Recommended State Rationale: A state of 'present' is recommended for all levels (Basic, Moderate, and Strict) because this control is foundational. There is no meaningful intermediate state; the system either monitors these critical events or it doesn't. The recommended rule is comprehensive, covering the primary syscalls for file deletion and renaming on both 32-bit and 64-bit architectures for non-system users (auid>=1000), which aligns with CIS Benchmark recommendations for a secure system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if the auditd rules for file deletion events are correctly configured. The script should query the loaded auditd rules using 'auditctl -l' and verify the presence of rules monitoring the 'unlink', 'unlinkat', 'rename', and 'renameat' syscalls for both 32-bit and 64-bit architectures, with a key of 'delete'. It must return only 'true' if all required rules are present and 'false' otherwise, with no other text.

## Remediation Script Working

shell script that accepts one positional argument: 'present'. If the argument is 'present', the script must add the necessary rules to a file in '/etc/audit/rules.d/' to log file deletion events ('unlink', 'unlinkat', 'rename', 'renameat' syscalls) for user IDs >= 1000. It must then run 'augenrules --load' to apply the configuration. The script must return 'true' on successful application of the rules and 'false' on failure.

