HIDS 5302

From Atomicorp Wiki
Revision as of 01:20, 30 March 2021 by Cpriester (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Rule ID



User missed the password to change UID to root.


This event occurs when a user attempts to 'su root' and types the wrong root password.


Repeated instances of this event could indicate attempted system abuse.

False Positives

There is no known false positive for this rule. This rule detects when files change, therefore, it is not recommended that you disable this rule. Instead, if you do not wish to be alerted when a specific file or files in a particular directory change, please log into the ASL GUI, click on the ASL tab, select the File Integrity menu options and modify your configuration to ignore this file or directory.

If you believe that this is a false positive, please report this to our security team can determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page.

Similar Rules


Knowledge Base Articles


Outside References


Personal tools