Auditd Field Spoofing: Now You Auditd Me, Now You Auditdon’t

This report walks through kernel-source analysis and a userspace proof-of-concept that changes a process's audit user id (auid/loginuid) via /proc/<pid>/loginuid using CAP_AUDIT_CONTROL, demonstrates the resulting audit log behavior (including an old-auid field), and provides detection and mitigation recommendations (e.g., ensure LOGIN events are sent to SIEM and consider audit/loginuid immutability).