Search code examples
linuxlinux-kernelaudit-logging

Tracing web shell attack with Linux audit system

I tried to trace web shell attack using Linux audit system. Following is the rule I appended.

-a exit,always -F arch=b64 -F gid=nginx -S execve

(using nginx)

With this setting, I can trace commands not 'pwd', but 'ls', 'cat'.

What are differences those had? And how can I trace all commands thoroughly?

Solution

  • Things like pwd are shell built-ins and do not involve the creation of another process, and thus no call to execve. The built-in commands supported depend on the shell you're using. Here are the built-ins supported by bash.

    I would recommend that you either run a modified version of the shell or that you trace something else, such as network traffic, if you really wish to capture all activity. Without more details on why you wish to capture this information, it is difficult to recommend an approach.