linux:auditd EXECVE

Program execution arguments

The argv of an execve call: the full command line of a new program.

Log source: Linux audit framework (auditd)
Host type: Linux
How to enable: auditd rules (audit.rules) select syscalls and paths; record types are emitted by the kernel and user-space tools.
Tier, host type: Minimum
Techniques: 5
Rules depending on it: Splunk 17, Sigma 145

Why this tier

ACSC web shell guidance; CISA/ASD; NSA/ASD web shell guidance

By role

Role	Tier	Basis
Linux server	Minimum	CISA/ASD
Linux web server, internet-facing	Minimum	ACSC web shell guidance; CISA/ASD; NSA/ASD web shell guidance

Techniques it helps detect

Rules that depend on it

Splunk 17

Sigma 145

Access of Sudoers File Content by Florian Roth (Nextron Systems)
Apache Spark Shell Command Injection - ProcessCreation by Nasreddine Bencherchali (Nextron Systems)
Atlassian Confluence CVE-2022-26134 by Nasreddine Bencherchali (Nextron Systems)
Audit Rules Deleted Via Auditctl by Mohamed LAKRI
Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator by Gene Kazimiarovich
Axios NPM Compromise Indicators - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
BPFtrace Unsafe Option Usage by Andreas Hunkeler (@Karneades)
Bash Interactive Shell by @d4ns4n_
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) by Andreas Braathen (mnemonic.io)
Capabilities Discovery - Linux by Nasreddine Bencherchali (Nextron Systems)
Capsh Shell Invocation - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Chmod Targeting Sensitive Directories by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Clipboard Collection with Xclip Tool by Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Connection Proxy by Ömer Günal
Container Residence Discovery Via Proc Virtual FS by Seth Hanford
Copy Passwd Or Shadow From TMP Path by Joseliyo Sanchez, @Joseliyo_Jstnk
Crontab Enumeration by Joseliyo Sanchez, @Joseliyo_Jstnk
Curl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
DD File Overwrite by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Decode Base64 Encoded Text by Daniil Yugoslavskiy, oscd.community
Disable Or Stop Services by Nasreddine Bencherchali (Nextron Systems)
Disabling Security Tools by Ömer Günal, Alejandro Ortuno, oscd.community
Docker Container Discovery Via Dockerenv Listing by Seth Hanford
Download File To Potentially Suspicious Directory Via Wget by Joseliyo Sanchez, @Joseliyo_Jstnk
ESXi Account Creation Via ESXCLI by Cedric Maurugeon
ESXi Admin Permission Assigned To Account Via ESXCLI by Nasreddine Bencherchali (Nextron Systems)
ESXi Network Configuration Discovery Via ESXCLI by Cedric Maurugeon
ESXi Storage Information Discovery Via ESXCLI by Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
ESXi Syslog Configuration Change Via ESXCLI by Cedric Maurugeon
ESXi System Information Discovery Via ESXCLI by Cedric Maurugeon
ESXi VM Kill Via ESXCLI by Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
ESXi VM List Discovery Via ESXCLI by Cedric Maurugeon
ESXi VSAN Information Discovery Via ESXCLI by Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
Enable BPF Kprobes Tracing by Nasreddine Bencherchali (Nextron Systems)
Execution Of Script Located In Potentially Suspicious Directory by Joseliyo Sanchez, @Joseliyo_Jstnk
File Deletion by Ömer Günal, oscd.community
File and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Flush Iptables Ufw Chain by Joseliyo Sanchez, @Joseliyo_Jstnk
Group Has Been Deleted Via Groupdel by Tuan Le (NCSGroup)
History File Deletion by Florian Roth (Nextron Systems)
Inline Python Execution - Spawn Shell Via OS System Library by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Install Root Certificate by Ömer Günal, oscd.community
Interactive Bash Suspicious Children by Florian Roth (Nextron Systems)
Kaspersky Endpoint Security Stopped Via CommandLine - Linux by Milad Cheraghi
Linux Base64 Encoded Pipe to Shell by pH-T (Nextron Systems)
Linux Base64 Encoded Shebang In CLI by Nasreddine Bencherchali (Nextron Systems)
Linux Crypto Mining Indicators by Florian Roth (Nextron Systems)
Linux Doas Tool Execution by Sittikorn S, Teoderick Contreras
Linux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Linux Logs Clearing Attempts by Ömer Günal, oscd.community
Linux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])
Linux Package Uninstall by Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)
Linux Recon Indicators by Florian Roth (Nextron Systems)
Linux Remote System Discovery by Alejandro Ortuno, oscd.community
Linux Setgid Capability Set on a Binary via Setcap Utility by Luc Génaux
Linux Setuid Capability Set on a Binary via Setcap Utility by Luc Génaux
Linux Shell Pipe to Shell by Florian Roth (Nextron Systems)
Linux Sudo Chroot Execution by Swachchhanda Shrawn Poudel (Nextron Systems)
Linux Suspicious Child Process from Node.js - React2Shell by Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
Linux Webshell Indicators by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
LiteLLM / TeamPCP Supply Chain Attack Indicators by Swachchhanda Shrawan Poudel (Nextron Systems)
Local Groups Discovery - Linux by Ömer Günal, Alejandro Ortuno, oscd.community
Local System Accounts Discovery - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Mask System Power Settings Via Systemctl by Milad Cheraghi, Nasreddine Bencherchali
Mount Execution With Hidepid Parameter by Joseliyo Sanchez, @Joseliyo_Jstnk
Named Pipe Created Via Mkfifo by Nasreddine Bencherchali (Nextron Systems)
Nohup Execution by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
OMIGOD SCX RunAsProvider ExecuteScript by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
OMIGOD SCX RunAsProvider ExecuteShellCommand by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
OS Architecture Discovery Via Grep by Joseliyo Sanchez, @Joseliyo_Jstnk
PUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
Pnscan Binary Data Transmission Activity by David Burkett (@signalblur)
Potential Container Discovery Via Inodes Listing by Seth Hanford
Potential Discovery Activity Using Find - Linux by Nasreddine Bencherchali (Nextron Systems)
Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process by Arnim Rupp, Nasreddine Bencherchali, Thomas Patzke
Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 by Milad Cheraghi
Potential GobRAT File Discovery Via Grep by Joseliyo Sanchez, @Joseliyo_Jstnk
Potential Linux Amazon SSM Agent Hijacking by Muhammad Faisal
Potential Linux Process Code Injection Via DD Utility by Joseph Kamau
Potential Netcat Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
Potential PHP Reverse Shell by @d4ns4n_
Potential Perl Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
Potential Ruby Reverse Shell by @d4ns4n_
Potential Suspicious Change To Sensitive/Critical Files by @d4ns4n_ (Wuerth-Phoenix)
Potential Xterm Reverse Shell by @d4ns4n_
Potentially Suspicious Execution From Tmp Folder by Joseliyo Sanchez, @Joseliyo_Jstnk
Potentially Suspicious Named Pipe Created Via Mkfifo by Nasreddine Bencherchali (Nextron Systems)
Print History File Contents by Florian Roth (Nextron Systems)
Process Discovery by Ömer Günal, oscd.community, CheraaghiMilad
Process Execution From Shared Memory Directory by Stan Beukers
Python One-Liners with Base64 Decoding - Linux by Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
Python Reverse Shell Execution Via PTY And Socket Modules by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
Python Spawning Pretty TTY Via PTY Module by Nextron Systems
Python WebServer Execution - Linux by Mohamed LAKRI
Remote Access Tool - Team Viewer Session Started On Linux Host by Josh Nickels, Qi Nan
Remove Immutable File Attribute by Nasreddine Bencherchali (Nextron Systems)
Remove Scheduled Cron Task/Job by Nasreddine Bencherchali (Nextron Systems)
Scheduled Cron Task/Job - Linux by Alejandro Ortuno, oscd.community
Scheduled Task/Job At by Ömer Günal, oscd.community
Script Interpreter Spawning Credential Scanner - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
Security Software Discovery - Linux by Daniil Yugoslavskiy, oscd.community
Setuid and Setgid by Ömer Günal
Shai-Hulud 2.0 Malicious NPM Package Installation - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
Shai-Hulud Malicious Bun Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
Shai-Hulud Malware Indicators - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
Shai-Hulud NPM Package Malicious Exfiltration via Curl by Swachchhanda Shrawan Poudel (Nextron Systems)
Shell Execution GCC - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Shell Execution Of Process Located In Tmp Directory by Joseliyo Sanchez, @Joseliyo_Jstnk
Shell Execution via Find - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Shell Execution via Flock - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Shell Execution via Git - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Shell Execution via Nice - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Shell Execution via Rsync - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth
Shell Invocation Via Ssh - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Shell Invocation via Apt - Linux by Nasreddine Bencherchali (Nextron Systems)
Shell Invocation via Env Command - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Shell Spawned by Celery Worker Process by Jennifer Batina
Sudo Privilege Escalation CVE-2019-14287 by Florian Roth (Nextron Systems)
Suspicious Child Process of SAP NetWeaver - Linux by Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
Suspicious Curl Change User Agents - Linux by Nasreddine Bencherchali (Nextron Systems)
Suspicious Curl File Upload - Linux by Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
Suspicious Download and Execute Pattern via Curl/Wget by Aayush Gupta
Suspicious Git Clone - Linux by Nasreddine Bencherchali (Nextron Systems)
Suspicious Invocation of Shell via AWK - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Suspicious Invocation of Shell via Rsync by Florian Roth
Suspicious Java Children Processes by Nasreddine Bencherchali (Nextron Systems)
Suspicious Nohup Execution by Joseliyo Sanchez, @Joseliyo_Jstnk
Suspicious Package Installed - Linux by Nasreddine Bencherchali (Nextron Systems)
Syslog Clearing or Removal Via System Utilities by Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
System Information Discovery by Ömer Günal, oscd.community
System Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
System Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
TanStack Supply-Chain Attack Execution Indicators - Linux by Leonardo Gasparini
Terminate Linux Process Via Kill by Tuan Le (NCSGroup)
Touch Suspicious Service File by Joseliyo Sanchez, @Joseliyo_Jstnk
Triple Cross eBPF Rootkit Execve Hijack by Nasreddine Bencherchali (Nextron Systems)
Triple Cross eBPF Rootkit Install Commands by Nasreddine Bencherchali (Nextron Systems)
UFW Disable Attempt by Joseliyo Sanchez, @Joseliyo_Jstnk
UNC4841 - Download Compressed Files From Temp.sh Using Wget by Nasreddine Bencherchali (Nextron Systems)
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget by Nasreddine Bencherchali (Nextron Systems)
UNC4841 - Potential SEASPY Execution by Nasreddine Bencherchali (Nextron Systems)
UNC4841 - SSL Certificate Exfiltration Via Openssl by Nasreddine Bencherchali (Nextron Systems)
User Added To Root/Sudoers Group Using Usermod by TuanLe (GTSC)
User Has Been Deleted Via Userdel by Tuan Le (NCSGroup)
Vim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux

Standards and guidance naming it

Requirement	Relation	Basis
OMB M-26-14: Indicators of compromiseAppendix B item 5(7)	Supports an activity	our analysis: command-line indicators
ASD ACSC / CISA et al.: Process creation and command-line auditingBest Practices for Event Logging and Threat Detection (Aug 2024)	Names this event	our analysis: EXECVE records satisfy command-line auditing on Linux
NSA and ASD: Web shell detection guidanceDetect and Prevent Web Shell Malware (CSI PP-20-0901, April 2020)	Names this event	quoted: auditd records of the web server process launching utilities (Appendix G)
ASD ACSC: Web shell guidanceWeb Shells: Threat Awareness and Guidance (2015)	Names this event	quoted: suspicious shell commands by the web server process

EDR events that stand in for it

Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.

Product	Sensor event	Fidelity	Basis
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	ProcessRollup2	Full	pySigma-backend-crowdstrike: process_creation; the Falcon sensor for Linux emits ProcessRollup2
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	SyntheticProcessRollup2	Full	pySigma-backend-crowdstrike: process_creation; the Falcon sensor for Linux emits ProcessRollup2
Microsoft Defender for Endpoint device tables	DeviceProcessEvents	Full	Defender for Endpoint on Linux populates DeviceProcessEvents
Elastic Defend endpoint events	process	Full	Elastic Defend for Linux process dataset