0048-libusrbin-add - File Added to /usr/bin Directory¶

Rule ID¶

• 0048-libusrbin-add

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitor the host directory /usr/bin for new files added.

Scan Frequency¶

• disable

Rationale¶

• The /usr/bin directory contains executable files for essential system commands. If new files are added, it is necessary to determine whether they are legitimate system commands.

Risk Items¶

• Feature Unavailable

Audit Method¶

• None

Remediation¶

• If a file is detected as deleted in the /usr/bin directory, check whether it is a legitimate system command.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None