For syscall hooking particularly, raw tracepoing is being triggered first. The raw tracepoint sys_enter is specified at entry point of all syscalls (do_syscall_x64 ...), then to be dispatched to the actual handler (eg: __x64_sys_execve or __ia32_sys_execve).

Double-check it on your own: https://elixir.bootlin.com/linux/v5.8/source/arch/x86/entry/common.c#L368