Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)
Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.
- Product
- linux
- Service
- auditd
- Author
- Ilyas Ochkov, Beyu Denis, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-12
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags processes executed by a specific web server user that invoke execve or execveat, consistent with remote command execution from a web application or web shell. Attackers rely on process execution to run arbitrary payloads under the web server’s privileges, enabling persistence and further compromise. It relies on Linux auditd syscall telemetry for execve/execveat events and matches the effective user ID of the web server account.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)"
id: a110870c-bbc7-4606-ae9e-078b87b8925f
status: test
description: This rule flags processes executed by a specific web server user that invoke execve or execveat, consistent with remote command execution from a web application or web shell. Attackers rely on process execution to run arbitrary payloads under the web server’s privileges, enabling persistence and further compromise. It relies on Linux auditd syscall telemetry for execve/execveat events and matches the effective user ID of the web server account.
references:
- Personal Experience of the Author
- https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_web_rce.yml
author: Ilyas Ochkov, Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-12
modified: 2025-12-05
tags:
- attack.persistence
- attack.t1505.003
logsource:
product: linux
service: auditd
definition: |
Required auditd configuration:
-a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www
-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www
-a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www
-a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www
Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
detection:
selection:
type: SYSCALL
SYSCALL:
- execve
- execveat
euid: 33
condition: selection
falsepositives:
- Admin activity
- Crazy web applications
level: critical
license: DRL-1.1
related:
- id: c0d3734d-330f-4a03-aae2-65dacc6a8222
type: derived