Add the following to audit.rules:
-a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
-a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
-a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec
-a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec
From my testing, this appears to catch the execution of all suid/sgit binaries without digging all over the system to figure out what they are. As an added bonus, you get to find out about binaries that pop onto your system for a brief period.
Thanks,
Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com-- This account not approved for unencrypted proprietary information --