execveat is a Linux system call used to launch a program with an alternate execution path. Instead of relying only on a normal pathname, it can execute a file relative to a directory file descriptor and, with certain flags, run a program in ways that differ from traditional execve behavior. This makes it a low-level building block for process creation on Unix-like systems.
In security work, execveat matters because defenses that watch only classic path-based execution can miss it. Attackers may use it to bypass simplistic allowlists, confuse auditing, or trigger code through less obvious file references. Defenders need to account for it in syscall filters, sandbox rules, and command-interception features such as those used by privilege-management tools. If a policy engine does not treat execveat as an execution event, a user may launch software outside the intended control path.