Jun 26 10:20:48 bastion LinuxCommandsWazuh: User ubuntu [9197]:   500  sudo ./log.sh 
Jun 26 10:21:08 bastion LinuxCommandsWazuh: User ubuntu [9197]:   501  pwd
Jun 26 10:21:36 bastion LinuxCommandsWazuh: User ubuntu [9197]:   502  crontab -e
Jun 26 10:54:47 bastion LinuxCommandsWazuh: User ubuntu [9197]:   502  crontab -e
Jun 26 10:54:51 bastion LinuxCommandsWazuh: User ubuntu [9197]:   503  history
Jun 26 10:55:54 bastion LinuxCommandsWazuh: User ubuntu [9197]:   503  history
Jun 26 10:56:17 bastion LinuxCommandsWazuh: User ubuntu [9197]:   504  psql -h 10.53.208.3 -d nitrox_v2 -U dbuser
Jun 26 10:58:15 bastion LinuxCommandsWazuh: User ubuntu [9197]:   504  psql -h 10.53.208.3 -d nitrox_v2 -U dbuser
Jun 26 10:59:13 bastion LinuxCommandsWazuh: User ubuntu [9197]:   505  sudo vi ~/.bashrc
Jun 26 10:59:19 bastion LinuxCommandsWazuh: User ubuntu [9197]:   506  source ~/.bashrc
Jun 26 10:59:24 bastion LinuxCommandsWazuh: User ubuntu [9197]:   507  psql
Jun 26 10:59:28 bastion LinuxCommandsWazuh: User ubuntu [9197]:   508  sudo su devesh
Jun 26 10:59:33 bastion LinuxCommandsWazuh: User ubuntu [9197]:   509  cd ..
Jun 26 10:59:33 bastion LinuxCommandsWazuh: User ubuntu [9197]:   510  ls
Jun 26 10:59:35 bastion LinuxCommandsWazuh: User ubuntu [9197]:   511  cd ..
Jun 26 10:59:35 bastion LinuxCommandsWazuh: User ubuntu [9197]:   512  ls
Jun 26 10:59:41 bastion LinuxCommandsWazuh: User rihan [9819]:     2  ls
Jun 26 10:59:44 bastion LinuxCommandsWazuh: User rihan [9819]:     3  psql
Jun 26 10:59:59 bastion LinuxCommandsWazuh: User ubuntu [9197]:   513  sudo su rihan
Jun 26 11:00:07 bastion LinuxCommandsWazuh: User ubuntu [9197]:   514  source ~/.bashrc
Jun 26 11:01:02 bastion LinuxCommandsWazuh: User ubuntu [9197]:   515  sudo vi ~/.bashrc
Jun 26 11:01:04 bastion LinuxCommandsWazuh: User ubuntu [9197]:   516  source ~/.bashrc
Jun 26 11:01:10 bastion LinuxCommandsWazuh: User ubuntu [9197]:   517  mongo
Jun 26 11:01:15 bastion LinuxCommandsWazuh: User ubuntu [9197]:   518  redis
Jun 26 11:01:21 bastion LinuxCommandsWazuh: User rihan [9922]:     4  exit
Jun 26 11:01:41 bastion LinuxCommandsWazuh: User rihan [9922]:     4  exit
Jun 26 11:01:45 bastion LinuxCommandsWazuh: User rihan [9922]:     4  exit
Jun 26 11:02:20 bastion LinuxCommandsWazuh: User rihan [9922]:     5  psql
Jun 26 11:02:27 bastion LinuxCommandsWazuh: User ubuntu [9197]:   519  sudo su rihan
Jun 26 11:02:29 bastion LinuxCommandsWazuh: User ubuntu [9197]:   520  ls
Jun 26 11:02:34 bastion LinuxCommandsWazuh: User ubuntu [9197]:   521  sudo su shamailtayyab/
Jun 26 11:02:36 bastion LinuxCommandsWazuh: User shamailtayyab [9993]: 
Jun 26 11:02:51 bastion LinuxCommandsWazuh: User shamailtayyab [9993]: 
Jun 26 11:02:54 bastion LinuxCommandsWazuh: User shamailtayyab [9993]: 
Jun 26 11:02:58 bastion LinuxCommandsWazuh: User shamailtayyab [9993]:     1  psql
Jun 26 11:03:01 bastion LinuxCommandsWazuh: User ubuntu [9197]:   522  sudo su shamailtayyab
Jun 26 11:03:02 bastion LinuxCommandsWazuh: User ubuntu [9197]:   523  ls
Jun 26 13:29:05 bastion LinuxCommandsWazuh: User ubuntu [9197]:   523  ls
Jun 26 13:29:06 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ubuntu [9197]:   523  ls]
Jun 26 13:29:07 bastion LinuxCommandsWazuh: User ubuntu [9197]:   524  cd .ss
Jun 26 13:29:12 bastion LinuxCommandsWazuh: User ubuntu [9197]:   525  cd ..sh
Jun 26 13:29:13 bastion LinuxCommandsWazuh: User ubuntu [9197]:   526  ls
Jun 26 13:31:59 bastion LinuxCommandsWazuh: User ubuntu [1038]:   527  sudo reboot
Jun 26 13:32:04 bastion LinuxCommandsWazuh: User ubuntu [1038]:   528  cd .ssh/
Jun 26 13:32:05 bastion LinuxCommandsWazuh: User ubuntu [1038]:   529  ls
Jun 26 13:32:06 bastion LinuxCommandsWazuh: User ubuntu [1038]:   530  cat authorized_keys 
Jun 26 13:33:08 bastion LinuxCommandsWazuh: User ubuntu [1038]:   531  sudo vi  authorized_keys 
Jun 26 13:34:11 bastion LinuxCommandsWazuh: User ubuntu [1038]:   531  sudo vi  authorized_keys 
Jun 26 13:34:17 bastion LinuxCommandsWazuh: User ubuntu [1038]:   532  ls
Jun 26 13:34:18 bastion LinuxCommandsWazuh: User ubuntu [1038]:   532  ls
Jun 26 13:35:04 bastion LinuxCommandsWazuh: User ubuntu [1038]:   533  sudo vi  authorized_keys 
Jun 26 13:35:21 bastion LinuxCommandsWazuh: User ubuntu [1227]:   527  sudo reboot
Jun 26 13:35:22 bastion LinuxCommandsWazuh: User ubuntu [1227]:   528  ls
Jun 26 13:45:22 bastion LinuxCommandsWazuh: User ubuntu [1227]:   528  ls
Jun 26 13:45:24 bastion LinuxCommandsWazuh: User ubuntu [1227]:   529  cd .ssh/
Jun 26 13:45:24 bastion LinuxCommandsWazuh: User ubuntu [1227]:   530  ls
Jun 26 13:45:26 bastion LinuxCommandsWazuh: User ubuntu [1227]:   531  cat authorized_keys 
Jun 26 13:48:37 bastion LinuxCommandsWazuh: User rihan [1422]:     6  exit
Jun 26 13:50:33 bastion LinuxCommandsWazuh: User ubuntu [1227]:   531  cat authorized_keys 
Jun 26 13:51:07 bastion LinuxCommandsWazuh: User ubuntu [1227]:   531  cat authorized_keys 
Jun 26 13:56:35 bastion LinuxCommandsWazuh: User ubuntu [1227]:   531  cat authorized_keys 
Jun 26 13:56:36 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ubuntu [1227]:   531  cat authorized_keys ]
Jun 26 13:56:37 bastion LinuxCommandsWazuh: User ubuntu [1227]:   532  ls
Jun 26 13:58:01 bastion LinuxCommandsWazuh: User ubuntu [1227]:   533  sudo vi authorized_keys 
Jun 26 14:00:16 bastion LinuxCommandsWazuh: User ubuntu [1038]:   533  sudo vi  authorized_keys 
Jun 26 14:00:17 bastion LinuxCommandsWazuh: message repeated 4 times: [ User ubuntu [1038]:   533  sudo vi  authorized_keys ]
Jun 26 14:46:18 bastion LinuxCommandsWazuh: User ubuntu [1227]:   533  sudo vi authorized_keys 
Jun 26 14:46:18 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ubuntu [1227]:   533  sudo vi authorized_keys ]