STIGQter: STIG Summary: HYCU Protege Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The HYCU virtual appliance must audit the execution of privileged functions.

DISA Rule

SV-268226r1038378_rule

Vulnerability Number

V-268226

Group Title

SRG-APP-000343-NDM-000289

Rule Version

HYCU-ND-000080

Severity

CAT II

CCI(s)

• CCI-002234 - Log the execution of privileged functions.

Weight

10

Fix Recommendation

Configure HYCU to audit the execution of the "execve" system call.

Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv

-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv

Reboot the appliance to take effect.

Check Contents

Check the contents of the "/var/log/audit/audit.log" file.

HYCU also maintains Event (Audit) information in the HYCU Web UI Events menu.

Verify the audit log contains records showing when the execution of privileged functions occurred.

If the audit log is not configured or does not have the required contents, this is a finding.

Vulnerability Number

V-268226

Documentable

False

Rule Version

HYCU-ND-000080

Severity Override Guidance

Check the contents of the "/var/log/audit/audit.log" file.

HYCU also maintains Event (Audit) information in the HYCU Web UI Events menu.

Verify the audit log contains records showing when the execution of privileged functions occurred.

If the audit log is not configured or does not have the required contents, this is a finding.

Check Content Reference

M

Target Key

5660