STIGhub
STIGs
RMF Controls
Compare
← MA-3 (5) — Maintenance Tools
CCI-004188
Definition
Monitor the use of maintenance tools that execute with increased privilege.
Parent Control
MA-3 (5)
Maintenance Tools
Maintenance
Linked STIG Checks (23)
V-274018
CAT II
Amazon Linux 2023 must produce audit records containing information to establish what type of events occurred.
Amazon Linux 2023 Security Technical Implementation Guide
V-268091
CAT II
NixOS must generate audit records for all usage of privileged commands.
Anduril NixOS Security Technical Implementation Guide
V-268454
CAT II
The macOS system must enable security auditing.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277062
CAT II
The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-260649
CAT II
Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270689
CAT II
Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-269129
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-263658
CAT II
The operating system must monitor the use of maintenance tools that execute with increased privilege.
General Purpose Operating System Security Requirements Guide
V-278070
CAT II
Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278071
CAT II
Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-248520
CAT II
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
Oracle Linux 8 Security Technical Implementation Guide
V-271570
CAT II
OL 9 must audit uses of the execve system call.
Oracle Linux 9 Security Technical Implementation Guide
V-281116
CAT II
RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281140
CAT II
RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281141
CAT II
RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281142
CAT II
RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258152
CAT II
RHEL 9 audit service must be enabled.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-275733
CAT II
Ubuntu OS must prevent all software from executing at higher privilege levels than users executing the software, and the audit system must be configured to audit the execution of privileged functions.
Riverbed NetIM OS Security Technical Implementation Guide
V-275734
CAT II
Ubuntu OS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions, and other system-level access.
Riverbed NetIM OS Security Technical Implementation Guide
V-216246
CAT II
The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.
Solaris 11 SPARC Security Technical Implementation Guide
V-216011
CAT II
The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.
Solaris 11 X86 Security Technical Implementation Guide
V-253052
CAT II
The TOSS audit system must audit local events.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-264323
CAT II
The VMM must monitor the use of maintenance tools that execute with increased privilege.
Virtual Machine Manager Security Requirements Guide