# Ensure use of privileged commands are collected

Necessity: Monitoring the use of privileged commands is critical for detecting and investigating unauthorized privilege escalation. Programs with `setuid` or `setgid` bits run with the permissions of the file's owner (often root) instead of the user executing them. Attackers frequently exploit vulnerabilities in these programs to gain root access. Without auditing, an attacker's lateral movement and privilege escalation activities could go completely undetected, creating a major security blind spot and severely hindering forensic investigation.

Auditing and Remediation: The audit script verifies that the system's audit daemon (`auditd`) is configured to log every execution of a `setuid`/`setgid` program. It does this by checking for specific rules in the `/etc/audit/rules.d/` directory. The remediation script ensures these critical rules are in place by adding them to a configuration file and reloading the `auditd` service to apply them immediately.

Recommended State Rationale:
- Basic: ['present'] - This is a fundamental security requirement. Having these audit rules provides a baseline for incident response and is considered a minimum best practice for any production server.
- Moderate: ['present'] - For a moderately hardened system, this setting is non-negotiable. The risk of untracked privilege escalation is too high to leave this disabled. The configuration is binary; it is either enabled or not.
- Strict: ['present'] - In a high-security environment, this is a mandatory control. Compliance frameworks like the CIS Benchmarks require it. For strict security, ensuring these events are logged is essential for a robust defense-in-depth and intrusion detection strategy.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the auditd rules located in `/etc/audit/rules.d/`. The script should check for the presence of rules that audit the `execve` system call for privilege escalation via `setuid` and `setgid` executables. Specifically, it should look for lines containing patterns like `-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0`. If all required rules for both 32-bit and 64-bit architectures are found, the script must return the string 'present'; otherwise, it must return 'absent'. The output should contain only the resulting string value.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state (e.g., 'present'). If the argument is 'present', the script must add the necessary auditd rules to a configuration file within `/etc/audit/rules.d/`, such as `50-privileged.rules`. The rules to add are: `-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0`, `-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0`, `-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0`, and `-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0`. After adding the rules, the script must reload the auditd configuration by running `augenrules --load`. The script must return 'true' upon successful application of the rules and 'false' on failure.

