audit_rules_file_deletion_events
by Paige, David B CTR USARMY ICOE (US)
This check and some related ones require auditing for all users and root. The suggested line includes these elements:
-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=500 -F auid!=4294967295 -k delete
Should this check include "-F auid=0" to properly audit the root user?