Linux Auditd Process Image Change Under Same PID

This analytic detects a successful Linux execve event where a PID changes executable image under the same parent after the prior image has been active for at least one second and no more than 60 seconds. A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.