Linux auditd: Webshell-like remote command execution via execve/execveat as web server user

title: "Linux auditd: Webshell-like remote command execution via execve/execveat as web server user"
id: a110870c-bbc7-4606-ae9e-078b87b8925f
status: test
description: This rule flags process execution events on Linux where the web server user (EUID 33 by default) runs execve or execveat. Web shells often use this behavior to execute attacker-supplied commands through the web server context, making the EUID-scoped syscall telemetry important for spotting suspicious command execution. It relies on auditd SYSCALL records for execve and execveat filtered to the configured web server effective UID.
references:
  - Personal Experience of the Author
  - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_web_rce.yml
author: Ilyas Ochkov, Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-12
modified: 2025-12-05
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www
    -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www
    -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www
    -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www
    Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
detection:
  selection:
    type: SYSCALL
    SYSCALL:
      - execve
      - execveat
    euid: 33
  condition: selection
falsepositives:
  - Admin activity
  - Crazy web applications
level: critical
license: DRL-1.1
related:
  - id: c0d3734d-330f-4a03-aae2-65dacc6a8222
    type: derived