Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

title: "Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)"
id: a110870c-bbc7-4606-ae9e-078b87b8925f
status: test
description: This rule flags processes executed by a specific web server user that invoke execve or execveat, consistent with remote command execution from a web application or web shell. Attackers rely on process execution to run arbitrary payloads under the web server’s privileges, enabling persistence and further compromise. It relies on Linux auditd syscall telemetry for execve/execveat events and matches the effective user ID of the web server account.
references:
  - Personal Experience of the Author
  - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_web_rce.yml
author: Ilyas Ochkov, Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-12
modified: 2025-12-05
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www
    -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www
    -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www
    -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www
    Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
detection:
  selection:
    type: SYSCALL
    SYSCALL:
      - execve
      - execveat
    euid: 33
  condition: selection
falsepositives:
  - Admin activity
  - Crazy web applications
level: critical
license: DRL-1.1
related:
  - id: c0d3734d-330f-4a03-aae2-65dacc6a8222
    type: derived