(type:EXECVE a0:chmod a1:777) OR (type:EXECVE a0:chmod a1:u\+s) OR (type:EXECVE a0:cp a1:\/bin\/ksh) OR (type:EXECVE a0:cp a1:\/bin\/sh)