SYSCALL record for execve

DISA STIG (linux); NSA/ASD web shell guidance

• T1001.002 Steganography
• T1001.003 Protocol or Service Impersonation
• T1003 OS Credential Dumping
• T1003.008 /etc/passwd and /etc/shadow
• T1005 Data from Local System
• T1007 System Service Discovery
• T1010 Application Window Discovery
• T1016 System Network Configuration Discovery
• T1016.001 Internet Connection Discovery
• T1016.002 Wi-Fi Discovery
• T1018 Remote System Discovery
• T1020 Automated Exfiltration
• T1021 Remote Services
• T1025 Data from Removable Media
• T1027 Obfuscated Files or Information
• T1027.001 Binary Padding
• T1027.002 Software Packing
• T1027.003 Steganography
• T1027.004 Compile After Delivery
• T1027.005 Indicator Removal from Tools
• T1027.006 HTML Smuggling
• T1027.010 Command Obfuscation
• T1027.013 Encrypted/Encoded File
• T1027.014 Polymorphic Code
• T1027.015 Compression
• T1027.016 Junk Code Insertion
• T1027.017 SVG Smuggling
• T1029 Scheduled Transfer
• T1033 System Owner/User Discovery
• T1036 Masquerading
• T1036.002 Right-to-Left Override
• T1036.003 Rename Legitimate Utilities
• T1036.005 Match Legitimate Resource Name or Location
• T1036.006 Space after Filename
• T1036.008 Masquerade File Type
• T1036.012 Browser Fingerprint
• T1037.004 RC Scripts
• T1040 Network Sniffing
• T1041 Exfiltration Over C2 Channel
• T1046 Network Service Discovery
• T1048 Exfiltration Over Alternative Protocol
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1049 System Network Connections Discovery
• T1053 Scheduled Task/Job
• T1053.002 At
• T1053.003 Cron
• T1055.008 Ptrace System Calls
• T1056.002 GUI Input Capture
• T1056.004 Credential API Hooking
• T1057 Process Discovery
• T1059 Command and Scripting Interpreter
• T1059.004 Unix Shell
• T1059.005 Visual Basic
• T1059.006 Python
• T1059.007 JavaScript
• T1059.011 Lua
• T1068 Exploitation for Privilege Escalation
• T1069 Permission Groups Discovery
• T1069.001 Local Groups
• T1069.002 Domain Groups
• T1070.003 Clear Command History
• T1070.004 File Deletion
• T1070.006 Timestomp
• T1070.007 Clear Network Connection History and Configurations
• T1070.008 Clear Mailbox Data
• T1070.009 Clear Persistence
• T1071 Application Layer Protocol
• T1071.001 Web Protocols
• T1071.002 File Transfer Protocols
• T1071.003 Mail Protocols
• T1071.004 DNS
• T1071.005 Publish/Subscribe Protocols
• T1072 Software Deployment Tools
• T1074 Data Staged
• T1074.001 Local Data Staging
• T1074.002 Remote Data Staging
• T1078 Valid Accounts
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1087.002 Domain Account
• T1090 Proxy
• T1090.001 Internal Proxy
• T1090.002 External Proxy
• T1090.004 Domain Fronting
• T1098.004 SSH Authorized Keys
• T1102.002 Bidirectional Communication
• T1102.003 One-Way Communication
• T1104 Multi-Stage Channels
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1110.002 Password Cracking
• T1113 Screen Capture
• T1115 Clipboard Data
• T1119 Automated Collection
• T1120 Peripheral Device Discovery
• T1132 Data Encoding
• T1176 Software Extensions
• T1176.001 Browser Extensions
• T1176.002 IDE Extensions
• T1190 Exploit Public-Facing Application
• T1195 Supply Chain Compromise
• T1195.001 Compromise Software Dependencies and Development Tools
• T1195.002 Compromise Software Supply Chain
• T1199 Trusted Relationship
• T1201 Password Policy Discovery
• T1203 Exploitation for Client Execution
• T1204 User Execution
• T1218 System Binary Proxy Execution
• T1219.002 Remote Desktop Software
• T1480 Execution Guardrails
• T1485 Data Destruction
• T1486 Data Encrypted for Impact
• T1491.001 Internal Defacement
• T1496 Resource Hijacking
• T1496.001 Compute Hijacking
• T1498.001 Direct Network Flood
• T1499 Endpoint Denial of Service
• T1499.003 Application Exhaustion Flood
• T1505 Server Software Component
• T1505.001 SQL Stored Procedures
• T1518.001 Security Software Discovery
• T1534 Internal Spearphishing
• T1543.005 Container Service
• T1546.005 Trap
• T1546.017 Udev Rules
• T1548.001 Setuid and Setgid
• T1552.004 Private Keys
• T1554 Compromise Host Software Binary
• T1555 Credentials from Password Stores
• T1556 Modify Authentication Process
• T1556.003 Pluggable Authentication Modules
• T1569 System Services
• T1620 Reflective Code Loading
• T1685.006 Clear Linux or Mac System Logs

No vendor rule names this event or source directly.

Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.