huntrule

Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.

FreeReviewedSigma · Critical · v3
Product
linux
Service
auditd
Author
Ilyas Ochkov, Beyu Denis, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags processes executed by a specific web server user that invoke execve or execveat, consistent with remote command execution from a web application or web shell. Attackers rely on process execution to run arbitrary payloads under the web server’s privileges, enabling persistence and further compromise. It relies on Linux auditd syscall telemetry for execve/execveat events and matches the effective user ID of the web server account.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange
Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)
Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Suspicious PHP Webshell Access with Hardcoded Key
Suspicious IIS Configuration Reconnaissance via Appcmd (via process_creation)
Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter
Malicious MOVEit human2 Webshell File Creation via file_event
Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)
Pivot detection · T1505.003 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.