CCI|CCI-004188

Title

Monitor the use of maintenance tools that execute with increased privilege.

Reference Item Details

Reference: CCI - DISA Control Correlation Identifier

Category: 2024

Audit Items

View all Reference Audit Items

Name	Plugin	Audit Name
ALMA-09-004970 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.	Unix	DISA CloudLinux AlmaLinux OS 9 STIG v1r1
APPL-14-001001 The macOS system must be configured to audit all administrative action events.	Unix	DISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-001003 The macOS system must enable security auditing.	Unix	DISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-15-001003 - The macOS system must enable security auditing.	Unix	DISA Apple macOS 15 (Sequoia) STIG v1r2
OL08-00-030181 - OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.	Unix	DISA Oracle Linux 8 STIG v2r2
RHEL-09-653015 - RHEL 9 audit service must be enabled.	Unix	DISA Red Hat Enterprise Linux 9 STIG v2r3
SOL-11.1-010040 - The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.	Unix	DISA STIG Solaris 11 X86 v3r1
SOL-11.1-010040 - The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.	Unix	DISA STIG Solaris 11 SPARC v3r1
UBTU-22-654235 - Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.	Unix	DISA Canonical Ubuntu 22.04 LTS STIG v2r3
UBTU-24-200580 - Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.	Unix	DISA Canonical Ubuntu 24.04 LTS STIG v1r1