Understanding the audit log [on hold] The Next CEO of Stack OverflowHow do I configure SELinux to allow outbound connections from a CGI script?How to interpret the “saddr” field of an audit log?File path in audit log instead of inode numberLinux ssh log auditHow to disable useless “audit success” log entries in dmesgUndocumented format of Linux Audit log recordsViewing relevant information about file accesses from the audit logConfiguring Solaris 11 AuditHostname in the audit reports not shownWhat is the Windows equivalent of 'Audit log cleared' event in Unix/Linux?

Does the Idaho Potato Commission associate potato skins with healthy eating?

what's the use of '% to gdp' type of variables?

Can someone explain this formula for calculating Manhattan distance?

Calculate the Mean mean of two numbers

Defamation due to breach of confidentiality

What is the difference between "hamstring tendon" and "common hamstring tendon"?

Can I board the first leg of the flight without having final country's visa?

Computationally populating tables with probability data

How to avoid supervisors with prejudiced views?

Is fine stranded wire ok for main supply line?

Expectation in a stochastic differential equation

Traveling with my 5 year old daughter (as the father) without the mother from Germany to Mexico

Is it ok to trim down a tube patch?

Inexact numbers as keys in Association?

What does "shotgun unity" refer to here in this sentence?

What was Carter Burke's job for "the company" in Aliens?

What CSS properties can the br tag have?

A question about free fall, velocity, and the height of an object.

Spaces in which all closed sets are regular closed

Airplane gently rocking its wings during whole flight

Is there an equivalent of cd - for cp or mv

Is there such a thing as a proper verb, like a proper noun?

Is French Guiana a (hard) EU border?

Do scriptures give a method to recognize a truly self-realized person/jivanmukta?



Understanding the audit log [on hold]



The Next CEO of Stack OverflowHow do I configure SELinux to allow outbound connections from a CGI script?How to interpret the “saddr” field of an audit log?File path in audit log instead of inode numberLinux ssh log auditHow to disable useless “audit success” log entries in dmesgUndocumented format of Linux Audit log recordsViewing relevant information about file accesses from the audit logConfiguring Solaris 11 AuditHostname in the audit reports not shownWhat is the Windows equivalent of 'Audit log cleared' event in Unix/Linux?










0















I need to understand the log below, my index.php got obfuscated with the following code, the file permissions changed from 644 to 755 as well.



I've got something in my audit but can't really tell what and how it happened, I was hoping for the actual way. The file got edited (obfuscated code inserted and chmod changed), log is below.



----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.319:12831615): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.319:12831615): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.319:12831615): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.319:12831615): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.335:12831626): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.335:12831626): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.335:12831626): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.335:12831626): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.996:12832312): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.996:12832312): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.996:12832312): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.996:12832312): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:23 2019
type=PROCTITLE msg=audit(1554067163.223:12837949): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067163.223:12837949): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067163.223:12837949): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067163.223:12837949): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834748): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834748): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834748): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834748): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834749): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834749): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834749): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834749): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.700:12836618): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.700:12836618): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.700:12836618): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.700:12836618): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13541 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.733:12836797): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.733:12836797): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.733:12836797): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.733:12836797): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13540 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.766:12836929): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.766:12836929): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.766:12836929): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.766:12836929): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----





centos logs audit malware







share|improve this question















put on hold as off-topic by slm♦ 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – slm
If this question can be reworded to fit the rules in the help center, please edit the question.











  • 1





    The @include string reads, after decoding the nnn codes as octal ASCII codes, /home/wrtsdavie/public_html/wp-content/upgrade/.b16b41d4.ico.

    – Kusalananda♦
    2 days ago











  • Hey @Kusalananda thanks, I've found that file and removed it. The question is how the file got modified, I had the audit rule running on that index.php as you can see.

    – evul
    2 days ago











  • Ufh, it looks like my audit happened after the file was changed. Figured out by using stat on index.php file. Thanks everyone

    – evul
    2 days ago















0















I need to understand the log below, my index.php got obfuscated with the following code, the file permissions changed from 644 to 755 as well.



I've got something in my audit but can't really tell what and how it happened, I was hoping for the actual way. The file got edited (obfuscated code inserted and chmod changed), log is below.



----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.319:12831615): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.319:12831615): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.319:12831615): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.319:12831615): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.335:12831626): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.335:12831626): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.335:12831626): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.335:12831626): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.996:12832312): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.996:12832312): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.996:12832312): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.996:12832312): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:23 2019
type=PROCTITLE msg=audit(1554067163.223:12837949): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067163.223:12837949): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067163.223:12837949): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067163.223:12837949): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834748): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834748): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834748): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834748): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834749): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834749): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834749): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834749): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.700:12836618): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.700:12836618): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.700:12836618): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.700:12836618): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13541 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.733:12836797): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.733:12836797): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.733:12836797): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.733:12836797): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13540 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.766:12836929): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.766:12836929): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.766:12836929): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.766:12836929): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----





centos logs audit malware







share|improve this question















put on hold as off-topic by slm♦ 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – slm
If this question can be reworded to fit the rules in the help center, please edit the question.











  • 1





    The @include string reads, after decoding the nnn codes as octal ASCII codes, /home/wrtsdavie/public_html/wp-content/upgrade/.b16b41d4.ico.

    – Kusalananda♦
    2 days ago











  • Hey @Kusalananda thanks, I've found that file and removed it. The question is how the file got modified, I had the audit rule running on that index.php as you can see.

    – evul
    2 days ago











  • Ufh, it looks like my audit happened after the file was changed. Figured out by using stat on index.php file. Thanks everyone

    – evul
    2 days ago













0












0








0








I need to understand the log below, my index.php got obfuscated with the following code, the file permissions changed from 644 to 755 as well.



I've got something in my audit but can't really tell what and how it happened, I was hoping for the actual way. The file got edited (obfuscated code inserted and chmod changed), log is below.



----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.319:12831615): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.319:12831615): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.319:12831615): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.319:12831615): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.335:12831626): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.335:12831626): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.335:12831626): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.335:12831626): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.996:12832312): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.996:12832312): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.996:12832312): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.996:12832312): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:23 2019
type=PROCTITLE msg=audit(1554067163.223:12837949): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067163.223:12837949): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067163.223:12837949): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067163.223:12837949): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834748): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834748): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834748): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834748): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834749): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834749): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834749): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834749): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.700:12836618): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.700:12836618): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.700:12836618): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.700:12836618): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13541 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.733:12836797): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.733:12836797): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.733:12836797): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.733:12836797): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13540 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.766:12836929): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.766:12836929): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.766:12836929): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.766:12836929): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----





centos logs audit malware







share|improve this question
















I need to understand the log below, my index.php got obfuscated with the following code, the file permissions changed from 644 to 755 as well.



I've got something in my audit but can't really tell what and how it happened, I was hoping for the actual way. The file got edited (obfuscated code inserted and chmod changed), log is below.



----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.319:12831615): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.319:12831615): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.319:12831615): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.319:12831615): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.335:12831626): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.335:12831626): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.335:12831626): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.335:12831626): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.996:12832312): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.996:12832312): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.996:12832312): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.996:12832312): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:23 2019
type=PROCTITLE msg=audit(1554067163.223:12837949): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067163.223:12837949): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067163.223:12837949): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067163.223:12837949): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834748): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834748): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834748): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834748): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834749): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834749): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834749): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834749): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.700:12836618): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.700:12836618): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.700:12836618): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.700:12836618): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13541 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.733:12836797): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.733:12836797): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.733:12836797): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.733:12836797): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13540 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.766:12836929): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.766:12836929): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.766:12836929): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.766:12836929): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----





centos logs audit malware




centos logs audit malware






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 4 hours ago







evul

















asked 2 days ago









evulevul

12




12




put on hold as off-topic by slm♦ 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – slm
If this question can be reworded to fit the rules in the help center, please edit the question.







put on hold as off-topic by slm♦ 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – slm
If this question can be reworded to fit the rules in the help center, please edit the question.







  • 1





    The @include string reads, after decoding the nnn codes as octal ASCII codes, /home/wrtsdavie/public_html/wp-content/upgrade/.b16b41d4.ico.

    – Kusalananda♦
    2 days ago











  • Hey @Kusalananda thanks, I've found that file and removed it. The question is how the file got modified, I had the audit rule running on that index.php as you can see.

    – evul
    2 days ago











  • Ufh, it looks like my audit happened after the file was changed. Figured out by using stat on index.php file. Thanks everyone

    – evul
    2 days ago












  • 1





    The @include string reads, after decoding the nnn codes as octal ASCII codes, /home/wrtsdavie/public_html/wp-content/upgrade/.b16b41d4.ico.

    – Kusalananda♦
    2 days ago











  • Hey @Kusalananda thanks, I've found that file and removed it. The question is how the file got modified, I had the audit rule running on that index.php as you can see.

    – evul
    2 days ago











  • Ufh, it looks like my audit happened after the file was changed. Figured out by using stat on index.php file. Thanks everyone

    – evul
    2 days ago







1




1





The @include string reads, after decoding the nnn codes as octal ASCII codes, /home/wrtsdavie/public_html/wp-content/upgrade/.b16b41d4.ico.

– Kusalananda♦
2 days ago





The @include string reads, after decoding the nnn codes as octal ASCII codes, /home/wrtsdavie/public_html/wp-content/upgrade/.b16b41d4.ico.

– Kusalananda♦
2 days ago













Hey @Kusalananda thanks, I've found that file and removed it. The question is how the file got modified, I had the audit rule running on that index.php as you can see.

– evul
2 days ago





Hey @Kusalananda thanks, I've found that file and removed it. The question is how the file got modified, I had the audit rule running on that index.php as you can see.

– evul
2 days ago













Ufh, it looks like my audit happened after the file was changed. Figured out by using stat on index.php file. Thanks everyone

– evul
2 days ago





Ufh, it looks like my audit happened after the file was changed. Figured out by using stat on index.php file. Thanks everyone

– evul
2 days ago










0






active

oldest

votes

















0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes

-

Popular posts from this blog

getting Checkpoint VPN SSL Network Extender working in the command lineHow to connect to CheckPoint VPN on Ubuntu 18.04LTS?Will the Linux ( red-hat ) Open VPNC Client connect to checkpoint or nortel VPN gateways?VPN client for linux machine + support checkpoint gatewayVPN SSL Network Extender in FirefoxLinux Checkpoint SNX tool configuration issuesCheck Point - Connect under Linux - snx + OTPSNX VPN Ububuntu 18.XXUsing Checkpoint VPN SSL Network Extender CLI with certificateVPN with network manager (nm-applet) is not workingWill the Linux ( red-hat ) Open VPNC Client connect to checkpoint or nortel VPN gateways?VPN client for linux machine + support checkpoint gatewayImport VPN config files to NetworkManager from command lineTrouble connecting to VPN using network-manager, while command line worksStart a VPN connection with PPTP protocol on command linestarting a docker service daemon breaks the vpn networkCan't connect to vpn with Network-managerVPN SSL Network Extender in FirefoxUsing Checkpoint VPN SSL Network Extender CLI with certificate

Image
If human space travel is limited by the G force vulnerability, is there a way to counter G forces? Did Shadowfax go to Valinor? Do I have a twin with permutated remainders? Blender 2.8 I can't see vertices, edges or faces in edit mode 1960's book about a plague that kills all white people How can I make my BBEG immortal short of making them a Lich or Vampire? Alternative to sending password over mail? Is it inappropriate for a student to attend their mentor's dissertation defense? Why is Collection not simply treated as Collection<?> Took a trip to a parallel universe, need help deciphering Assassin's bullet with mercury Why is it a bad idea to hire a hitman to eliminate most corrupt politicians? I Accidentally Deleted a Stock Terminal Theme Is there a hemisphere-neutral way of specifying a season? What about the virus in 12 Monkeys? Why can't we play rap on piano? Arrow those variables! Today is the Center Modeling an IP Ad...
Read more

대한민국 목차 국명 지리 역사 정치 국방 경제 사회 문화 국제 순위 관련 항목 각주 외부 링크 둘러보기 메뉴북위 37° 34′ 08″ 동경 126° 58′ 36″ / 북위 37.568889° 동경 126.976667°  / 37.568889; 126.976667ehThe Korean Repository문단을 편집문단을 편집추가해Clarkson PLC 사Report for Selected Countries and Subjects-Korea“Human Development Index and its components: P.198”“http://www.law.go.kr/%EB%B2%95%EB%A0%B9/%EB%8C%80%ED%95%9C%EB%AF%BC%EA%B5%AD%EA%B5%AD%EA%B8%B0%EB%B2%95”"한국은 국제법상 한반도 유일 합법정부 아니다" - 오마이뉴스 모바일Report for Selected Countries and Subjects: South Korea격동의 역사와 함께한 조선일보 90년 : 조선일보 인수해 혁신시킨 신석우, 임시정부 때는 '대한민국' 국호(國號) 정해《우리가 몰랐던 우리 역사: 나라 이름의 비밀을 찾아가는 역사 여행》“남북 공식호칭 ‘남한’‘북한’으로 쓴다”“Corea 대 Korea, 누가 이긴 거야?”국내기후자료 - 한국[김대중 前 대통령 서거] 과감한 구조개혁 'DJ노믹스'로 최단기간 환란극복 :: 네이버 뉴스“이라크 "韓-쿠르드 유전개발 MOU 승인 안해"(종합)”“해외 우리국민 추방사례 43%가 일본”차기전차 K2'흑표'의 세계 최고 전력 분석, 쿠키뉴스 엄기영, 2007-03-02두산인프라, 헬기잡는 장갑차 'K21'...내년부터 공급, 고뉴스 이대준, 2008-10-30과거 내용 찾기mk 뉴스 - 구매력 기준으로 보면 한국 1인당 소득 3만弗과거 내용 찾기"The N-11: More Than an Acronym"Archived조선일보 최우석, 2008-11-01Global 500 2008: Countries - South Korea“몇년째 '시한폭탄'... 가계부채, 올해는 터질까”가구당 부채 5000만원 처음 넘어서“‘빚’으로 내몰리는 사회.. 위기의 가계대출”“［경제365］ 공공부문 부채 급증…800조 육박”“"소득 양극화 다소 완화...불평등은 여전"”“공정사회·공생발전 한참 멀었네”iSuppli，08年2QのDRAMシェア・ランキングを発表(08/8/11)South Korea dominates shipbuilding industry | Stock Market News & Stocks to Watch from StraightStocks한국 자동차 생산, 3년 연속 세계 5위자동차수출 '현대-삼성 웃고 기아-대우-쌍용은 울고' 과거 내용 찾기동반성장위 창립 1주년 맞아Archived"중기적합 3개업종 합의 무시한 채 선정"李대통령, 사업 무분별 확장 소상공인 생계 위협 질타삼성-LG, 서민업종인 빵·분식사업 잇따라 철수상생은 뒷전…SSM ‘몸집 불리기’ 혈안Archived“경부고속도에 '아시안하이웨이' 표지판”'철의 실크로드' 앞서 '말(言)의 실크로드'부터, 프레시안 정창현, 2008-10-01“'서울 지하철은 안전한가?'”“서울시 “올해 안에 모든 지하철역 스크린도어 설치””“부산지하철 1,2호선 승강장 안전펜스 설치 완료”“전교조, 정부 노조 통계서 처음 빠져”“［Weekly BIZ］ 도요타 '제로 이사회'가 리콜 사태 불러들였다”“S Korea slams high tuition costs”““정치가 여론 양극화 부채질… 합리주의 절실””“〈"`촛불집회'는 민주주의의 질적 변화 상징"〉”““촛불집회가 민주주의 왜곡 초래””“국민 65%, "한국 노사관계 대립적"”“한국 국가경쟁력 27위‥노사관계 '꼴찌'”“제대로 형성되지 않은 대한민국 이념지형”“［신년기획-갈등의 시대］ 갈등지수 OECD 4위…사회적 손실 GDP 27% 무려 300조”“2012 총선-대선의 키워드는 '국민과 소통'”“한국 삶의 질 27위, 2000년과 2008년 연속 하위권 머물러”“［해피 코리아］ 행복점수 68점…해외 평가선 '낙제점'”“한국 어린이·청소년 행복지수 3년 연속 OECD ‘꼴찌’”“한국 이혼율 OECD중 8위”“［통계청］ 한국 이혼율 OECD 4위”“오피니언 ［이렇게 생각한다］ `부부의 날` 에 돌아본 이혼율 1위 한국”“Suicide Rates by Country, Global Health Observatory Data Repository.”“1. 또 다른 차별”“오피니언 ［편집자에게］ '왕따'와 '패거리 정치' 심리는 닮은꼴”“［미래한국리포트］ 무한경쟁에 빠진 대한민국”“대학생 98% "외모가 경쟁력이라는 말 동의"”“특급호텔 웨딩·200만원대 유모차… "남보다 더…" 호화病, 고질병 됐다”“［스트레스 공화국］ ① 경쟁사회, 스트레스 쌓인다”““매일 30여명 자살 한국, 의사보다 무속인에…””“"자살 부르는 '우울증', 환자 중 85% 치료 안 받아"”“정신병원을 가다”“대한민국도 ‘묻지마 범죄’,안전지대 아니다”“유엔 "학생 '성적 지향'에 따른 차별 금지하라"”“유엔아동권리위원회 보고서 및 번역본 원문”“고졸 성공스토리 담은 '제빵왕 김탁구' 드라마 나온다”“‘빛 좋은 개살구’ 고졸 취업…실습 대신 착취”원본 문서“정신건강, 사회적 편견부터 고쳐드립니다”‘소통’과 ‘행복’에 목 마른 사회가 잠들어 있던 ‘심리학’ 깨웠다“［포토］ 사유리-곽금주 교수의 유쾌한 심리상담”“"올해 한국인 평균 영화관람횟수 세계 1위"(종합)”“［게임연중기획］ 게임은 문화다-여가활동 1순위 게임”“영화속 ‘영어 지상주의’ …“왠지 씁쓸한데””“2월 `신문 부수 인증기관` 지정..방송법 후속작업”“무료신문 성장동력 ‘차별성’과 ‘갈등해소’”대한민국 국회 법률지식정보시스템"Pew Research Center's Religion & Public Life Project: South Korea"“amp;vwcd=MT_ZTITLE&path=인구·가구%20>%20인구총조사%20>%20인구부문%20>%20 총조사인구(2005)%20>%20전수부문&oper_YN=Y&item=&keyword=종교별%20인구& amp;lang_mode=kor&list_id= 2005년 통계청 인구 총조사”원본 문서“한국인이 좋아하는 취미와 운동 (2004-2009)”“한국인이 좋아하는 취미와 운동 (2004-2014)”Archived“한국, `부분적 언론자유국' 강등〈프리덤하우스〉”“국경없는기자회 "한국, 인터넷감시 대상국"”“한국, 조선산업 1위 유지(S. Korea Stays Top Shipbuilding Nation) RZD-Partner Portal”원본 문서“한국, 4년 만에 ‘선박건조 1위’”“옛 마산시,인터넷속도 세계 1위”“"한국 초고속 인터넷망 세계1위"”“인터넷·휴대폰 요금, 외국보다 훨씬 비싸”“한국 관세행정 6년 연속 세계 '1위'”“한국 교통사고 사망자 수 OECD 회원국 중 2위”“결핵 후진국' 한국, 환자가 급증한 이유는”“수술은 신중해야… 자칫하면 생명 위협”대한민국분류대한민국의 지도대한민국 정부대표 다국어포털대한민국 전자정부대한민국 국회한국방송공사about korea and information korea브리태니커 백과사전(한국편)론리플래닛의 정보(한국편)CIA의 세계 정보(한국편)마리암 부디아 (Mariam Budia),『한국: 하늘이 내린 한 폭의 그림』, 서울: 트랜스라틴 19호 (2012년 3월)대한민국ehehehehehehehehehehehehehehWorldCat132441370n791268020000 0001 2308 81034078029-6026373548cb11863345f(데이터)00573706ge128495

Image
고조선원삼국 시대삼국 시대남북국 시대후삼국 시대고려조선대한제국일제 강점기대한민국 임시 정부한반도 분단미군정개요제1공화국제2공화국제3공화국제4공화국제5공화국제6공화국4.3 사건6.25 전쟁4.19 혁명5.16 쿠테타한강의 기적부마 항쟁10.26 사태12.12 사태광주 민주화 운동6월 항쟁1988년 서울올림픽IMF 외환...
Read more

Cannot Extend partition with GParted The 2019 Stack Overflow Developer Survey Results Are In Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) 2019 Community Moderator Election ResultsCan't increase partition size with GParted?GParted doesn't recognize the unallocated space after my current partitionWhat is the best way to add unallocated space located before to Ubuntu 12.04 partition with GParted live?I can't figure out how to extend my Arch home partition into free spaceGparted Linux Mint 18.1 issueTrying to extend but swap partition is showing as Unknown in Gparted, shows proper from fdiskRearrange partitions in gparted to extend a partitionUnable to extend partition even though unallocated space is next to it using GPartedAllocate free space to root partitiongparted: how to merge unallocated space with a partition

Image
Make it rain characters Keeping a retro style to sci-fi spaceships? How to split my screen on my Macbook Air? How can I define good in a religion that claims no moral authority? does high air pressure throw off wheel balance? Scientific Reports - Significant Figures Relations between two reciprocal partial derivatives? How to delete random line from file using Unix command? How did passengers keep warm on sail ships? How are presidential pardons supposed to be used? Are my PIs rude or am I just being too sensitive? He got a vote 80% that of Emmanuel Macron’s Change bounding box of math glyphs in LuaTeX Match Roman Numerals Was credit for the black hole image misattributed? How to pronounce 1ターン? how can a perfect fourth interval be considered either consonant or dissonant? Working through the single responsibility principle (SRP) in Python when calls are expensive High Q peak in frequency response means what in time domain? ...
Read more