| Verify "/var/log/audit" is mounted with the "noexec" option: |
$ sudo mount | grep /var/log/audit
/dev/mapper/rhel-var-log-audit on /var/log/audit type xfs (rw,nodev,nosuid,noexec,seclabel)
Verify that the "noexec" option is configured for /var/log/audit:
$ sudo cat /etc/fstab | grep /var/log/audit
/dev/mapper/rhel-var-log-audit /var/log/audit xfs defaults,nodev,nosuid,noexec 0 0
If results are returned and the "noexec" option is missing, or if /var/log/audit is mounted without the "noexec" option, this is a finding.