0051-libusrsbin-add - File Added to /usr/sbin Directory¶

Rule ID¶

• 0051-libusrsbin-add

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitors the host /usr/sbin directory for new files being added.

Scan Frequency¶

• disable

Rationale¶

• The /usr/sbin directory stores essential system command executables. If new files are added, it is necessary to determine whether they are legitimate system commands.

Risk Items¶

• Functionality unavailable

Audit Method¶

• None

Remediation¶

• If a file deletion is detected in the /sbin directory, verify whether it is a legitimate system command.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None