sample_auditd.rules

# Alert whenever anyone performs the mount() system call.
-a always,exit -S mount

# Alert whenever anyone performs an unlink() for a file below /usr/bin
-a always,exit -S unlink -S unlinkat -F dir=/usr/bin -F success=1

# Watch all activity related to /etc/shadow
# -k puts this rule and the following rule in a group
-w /etc/shadow -p wa -k passwd_mgmt

# Watch any invocation of /usr/bin/passwd
-w /usr/bin/passwd -p x -k passwd_mgmt

# Lock this configuration so it can't be changed.
-e 2