Ensure discretionary access control permission modification events are collected – auditctl b32 chown fchown
Details Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls...