it's taken from the AUDIT_PATH audit notification, so it's the mode of the executable that is being run