I've been looking for this for about 3 days now and have come up empty-handed. I am looking for a way to build a threat alert for Linux-based credential dumping in Splunk.
To do this I need to be able to monitor the
/proc directory. I found audit and auditd (audit deamon) but I don't know how to actually configure auditd to monitor the
/proc. If I could do this I could then connect audit.log to Splunk.
I want to at least monitor:
/proc/<PID>/maps /proc/<PID>/mem /proc/<PID>/cmdline
But ideally I want to monitor everything in
Has anyone here ever done this? If so I would really appreciate some help.
Additionally: I found klogd (kernel log deamon), syslogd and a ps and top combination but I don't know how to configure that to
/proc either or if that is even what I need.
Any advice is appreciated!
I am of course open to other methods and ideas.