Public bug reported: **Environment** - Ubuntu 22.04 LTS - Kernel: 6.8.0-124-generic - Hypervisor: VMware Workstation 17.6.4 - auditd 3.0.7
**Issue** auditd fails to capture binary execution events using watch rules with -p x and syscall rules using -S execve or -S connect with -F exe= filter. Rules load correctly (auditctl -l confirms) but no events are generated in /var/log/audit/audit.log. **What does NOT work** 1. Watch rules with -p x: sudo auditctl -w /usr/bin/curl -p x -k test_exec curl http://example.com sudo ausearch -k test_exec Result: <no matches> 2. Syscall execve without exe filter: sudo auditctl -a always,exit -F arch=b64 -S execve -k test_execve_all ls /tmp sudo ausearch -k test_execve_all Result: <no matches> 3. Syscall execve with exe filter: sudo auditctl -a always,exit -F arch=b64 -S execve -F exe=/usr/bin/curl -k test_execve curl http://example.com sudo ausearch -k test_execve Result: <no matches> **What works correctly** Watch rules with -p rwa on data files work as expected: sudo auditctl -w /etc/passwd -p rwa -k test_rwa cat /etc/passwd sudo ausearch -k test_rwa Result: Events captured correctly. **Expected behavior** All three rule types should capture events as documented. **Impact** Standard Sigma detection rules from SigmaHQ that rely on auditd execve monitoring are ineffective in this environment, preventing detection of binary execution for security monitoring purposes. **Additional context** Discovered during empirical validation of detection rules in ARGOS, a research SOC framework built on Wazuh 4.9.2, developed as part of a cybersecurity master's thesis at Universidad Nebrija, Madrid. All detection rules are validated empirically before inclusion, which led to discovery of this anomaly. ProblemType: Bug DistroRelease: Ubuntu 22.04 Package: auditd 1:3.0.7-1build1 ProcVersionSignature: Ubuntu 6.8.0-124.124~22.04.1-generic 6.8.12 Uname: Linux 6.8.0-124-generic x86_64 ApportVersion: 2.20.11-0ubuntu82.10 Architecture: amd64 CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Sun Jul 26 23:13:33 2026 InstallationDate: Installed on 2026-07-03 (23 days ago) InstallationMedia: Ubuntu 22.04.5 LTS "Jammy Jellyfish" - Release amd64 (20240911) SourcePackage: audit UpgradeStatus: No upgrade log present (probably fresh install) modified.conffile..etc.audit.audit-stop.rules: [deleted] modified.conffile..etc.audit.auditd.conf: [deleted] modified.conffile..etc.audit.plugins.d.af_unix.conf: [deleted] modified.conffile..etc.audit.plugins.d.syslog.conf: [deleted] modified.conffile..etc.audit.rules.d.audit.rules: [deleted] ** Affects: audit (Ubuntu) Importance: Undecided Status: New ** Tags: auditd execve kernel-6.8 syscall vmware -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161851 Title: auditd watch -p x and syscall rules not capturing binary execution events on kernel 6.8 in VMware To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/audit/+bug/2161851/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
