# Ensure use of privileged commands are collected

Necessity: Auditing the use of privileged commands is a critical security function for establishing accountability and detecting potential misuse or compromise. Attackers who gain access to a system often seek to escalate their privileges to gain full control. Monitoring commands executed with root privileges provides a clear audit trail of administrative actions, helping to identify unauthorized privilege escalation, insider threats, or an attacker's lateral movement. Without this auditing, malicious administrative activity could go completely undetected, preventing effective incident response.

Auditing and Remediation: The audit script queries the active `auditd` rule set to confirm that rules are in place to monitor the `execve` system call, which is used to execute programs. It specifically checks for executions where an administrative user (`auid>=1000`) runs a command that results in root privileges (`euid=0`). The remediation script adds these precise rules to the auditd configuration, ensuring that such events are logged for future analysis, and then reloads the audit service to make the rules active.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Present'. This is a foundational, binary security control; either privileged access is monitored, or it is not. There is no meaningful intermediate state. This control is mandated by security benchmarks like CIS and STIGs as a non-negotiable requirement for a securely configured system. Therefore, regardless of the desired hardening level, these audit rules must be enabled to ensure system integrity and accountability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the loaded auditd rules by running `auditctl -l`. The script must parse this output to verify the existence of rules that track the execution of privileged commands. Specifically, it should look for rules monitoring the `execve` syscall where the effective user ID (`euid`) is 0 for an administrative audit user ID (`auid>=1000`). If such rules are present, the script must return only the string 'Present'. If they are not found, it must return only the string 'Not Present'.

## Remediation Script Working

Bash script that accepts one positional argument, which will be the desired state (e.g., 'Present'). If the argument is 'Present', the script must create or modify an auditd rule file (e.g., `/etc/audit/rules.d/privileged.rules`) to include rules that log privileged command execution. The rules should include, at a minimum: `-a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=-1 -k privileged` and the corresponding `arch=b32` rule. After writing the file, the script must run `augenrules --load` to apply the configuration. The script must return `true` on success and `false` on failure.

