Jul 1 06:38:48 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175241]: 1997 ls Jul 1 06:38:54 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 1997 ls Jul 1 06:38:55 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 1997 ls Jul 1 06:38:59 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175241]: 1998 kubetail Jul 1 06:39:00 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 1998 sudo su veky Jul 1 06:39:06 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 23 exit Jul 1 06:39:08 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 24 k get all Jul 1 06:39:29 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175241]: 1999 sudo apt install kubetail Jul 1 06:39:31 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 25 kubectl get all Jul 1 06:39:43 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 26 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:39:56 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175241]: 2000 kubetail Jul 1 06:40:10 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175241]: 2000 kubetail Jul 1 06:40:10 internal-jumper-server LinuxCommandsWazuh: message repeated 4 times: [ User ubuntu [1175241]: 2000 kubetail ] Jul 1 06:40:23 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175241]: 2001 kubetail -t Jul 1 06:41:33 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175241]: 2002 kubectl get po Jul 1 06:42:36 internal-jumper-server LinuxCommandsWazuh: User venky [1179194]: 23 exit Jul 1 06:42:39 internal-jumper-server LinuxCommandsWazuh: User venky [1179194]: 24 kubectl Jul 1 06:42:44 internal-jumper-server LinuxCommandsWazuh: User venky [1179194]: 25 kubectl get po Jul 1 06:43:38 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 26 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:43:38 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 26 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:43:38 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 26 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:43:38 internal-jumper-server LinuxCommandsWazuh: User venky [1176462]: 26 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:43:41 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 1999 sudo su venky Jul 1 06:43:48 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2000 k get all Jul 1 06:44:00 internal-jumper-server LinuxCommandsWazuh: User venky [1179814]: 27 exit Jul 1 06:44:02 internal-jumper-server LinuxCommandsWazuh: User venky [1179814]: 28 cd Jul 1 06:44:03 internal-jumper-server LinuxCommandsWazuh: User venky [1179814]: 29 cd .ssh/ Jul 1 06:44:04 internal-jumper-server LinuxCommandsWazuh: User venky [1179814]: 30 ls Jul 1 06:44:06 internal-jumper-server LinuxCommandsWazuh: User venky [1179814]: 31 cat authorized_keys Jul 1 06:44:09 internal-jumper-server LinuxCommandsWazuh: User venky [1179814]: 32 cd .. Jul 1 06:44:09 internal-jumper-server LinuxCommandsWazuh: User venky [1179814]: 33 ls Jul 1 06:44:12 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2001 sudo su venky Jul 1 06:44:17 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2002 cd .ssh/ Jul 1 06:44:17 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2003 ls Jul 1 06:44:46 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2004 sudo vi authorized_keys Jul 1 06:45:00 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2005 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:56:06 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2005 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:56:06 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2005 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:56:06 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2005 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:56:07 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2006 ls Jul 1 06:56:07 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2007 cd Jul 1 06:56:10 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2008 s Jul 1 06:56:10 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2009 ls Jul 1 06:56:12 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2010 ks Jul 1 06:56:14 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2011 cd toilet/ Jul 1 06:56:14 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2012 ls Jul 1 06:56:19 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2013 cd kube-test-files/ Jul 1 06:56:19 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2014 ls Jul 1 06:56:30 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2015 sudo vi service.json Jul 1 06:57:33 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2016 gcloud auth activate-service-account --key-file=/home/ubuntu/toilet/kube-test-files/service.json Jul 1 06:57:44 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2017 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 06:57:48 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2018 k get all Jul 1 06:57:57 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2018 k get all Jul 1 06:58:00 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 34 exit Jul 1 06:58:03 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 34 exit Jul 1 06:58:12 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 33 exit Jul 1 06:58:22 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 34 kubectl get all Jul 1 07:02:20 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 35 cd Jul 1 07:02:21 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 36 ls Jul 1 07:02:37 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 37 sudo vi servie.json Jul 1 07:02:52 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 38 gcloud auth activate-service-account --key-file=/home/devesh/service.json Jul 1 07:03:05 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 39 gcloud auth activate-service-account --key-file=/home/devesh/servie.json Jul 1 07:03:11 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 40 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 07:03:12 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 41 ls Jul 1 07:03:15 internal-jumper-server LinuxCommandsWazuh: User devesh [1184409]: 42 rm servie.json Jul 1 07:03:17 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 35 sudo su devesh Jul 1 07:03:19 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 36 cd Jul 1 07:03:20 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 37 ls Jul 1 07:03:35 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 38 sudo vi ser.json Jul 1 07:03:53 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 38 sudo vi ser.json Jul 1 07:04:00 internal-jumper-server LinuxCommandsWazuh: User venky [1184293]: 39 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 07:04:01 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2019 sudo su venky Jul 1 07:04:03 internal-jumper-server LinuxCommandsWazuh: User venky [1186980]: 40 exit Jul 1 07:04:05 internal-jumper-server LinuxCommandsWazuh: User venky [1186980]: 41 c Jul 1 07:04:06 internal-jumper-server LinuxCommandsWazuh: User venky [1186980]: 42 cd Jul 1 07:04:09 internal-jumper-server LinuxCommandsWazuh: User venky [1186980]: 43 rm ser.json Jul 1 07:04:13 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2019 sudo su venky Jul 1 07:04:19 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 14 exit Jul 1 07:04:20 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 15 cd Jul 1 07:04:21 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 16 ls Jul 1 07:04:30 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 17 sudo vi s.json Jul 1 07:04:48 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 17 sudo vi s.json Jul 1 07:04:53 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 18 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 07:04:59 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 19 rm s.json Jul 1 07:05:01 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 20 ls Jul 1 07:05:05 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 21 rm s.json Jul 1 07:05:06 internal-jumper-server LinuxCommandsWazuh: User rihan [1187071]: 22 ls Jul 1 07:05:08 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2020 sudo su rihan Jul 1 07:05:16 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1187340]: 158 exit Jul 1 07:05:17 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1187340]: 159 cd Jul 1 07:05:29 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1187340]: 160 sudo vi s.json Jul 1 07:05:45 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1187340]: 160 sudo vi s.json Jul 1 07:05:50 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1187340]: 161 gcloud container clusters get-credentials github-runner --zone asia-south2-a --project nitrox-415207 Jul 1 07:05:54 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1187340]: 162 rm s.json Jul 1 07:05:56 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2021 sudo su shamailtayyab Jul 1 07:05:56 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2022 ls Jul 1 07:05:57 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2023 cd Jul 1 07:06:01 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1175717]: 2024 k get all Jul 1 07:06:08 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 1997 exit Jul 1 07:06:11 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 1998 k get all Jul 1 07:06:14 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 1999 ls Jul 1 07:06:19 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2000 cd toilet/kube-test-files/ Jul 1 07:06:19 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2001 ls Jul 1 07:06:24 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2002 rm service.json Jul 1 07:08:35 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2002 rm service.json Jul 1 07:08:35 internal-jumper-server LinuxCommandsWazuh: message repeated 3 times: [ User ubuntu [1187679]: 2002 rm service.json ] Jul 1 07:08:38 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2003 cd Jul 1 07:08:38 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2004 ls Jul 1 07:08:44 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2004 ls Jul 1 08:10:05 internal-jumper-server LinuxCommandsWazuh: User venky [1200657]: 47 kubetail nitrox-dj-7db478b65-8p6ss Jul 1 08:13:17 internal-jumper-server LinuxCommandsWazuh: User venky [1202333]: 47 kubetail nitrox-dj-7db478b65-8p6ss Jul 1 08:13:18 internal-jumper-server LinuxCommandsWazuh: message repeated 3 times: [ User venky [1202333]: 47 kubetail nitrox-dj-7db478b65-8p6ss ] Jul 1 08:16:16 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2004 ls Jul 1 08:16:23 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1187679]: 2005 k get ingress Jul 1 08:23:33 internal-jumper-server LinuxCommandsWazuh: User venky [1202333]: 47 kubetail nitrox-dj-7db478b65-8p6ss Jul 1 08:28:45 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 1997 kubectl get po Jul 1 08:28:46 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 1998 ls Jul 1 08:28:50 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 1999 sudo su rihan2.ovpn Jul 1 08:28:56 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 23 exit Jul 1 08:28:57 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 24 cd Jul 1 08:28:57 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 25 ls Jul 1 08:28:59 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 26 cd .ssh/ Jul 1 08:28:59 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 27 ks Jul 1 08:29:01 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 28 ls Jul 1 08:29:02 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 29 cat ai Jul 1 08:29:04 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 30 cat authorized_keys Jul 1 08:29:48 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 31 sudo vi authorized_keys Jul 1 08:29:57 internal-jumper-server LinuxCommandsWazuh: User rihan [1209503]: 23 exit Jul 1 08:30:03 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 32 docker ps Jul 1 08:30:10 internal-jumper-server LinuxCommandsWazuh: User rihan [1209085]: 33 kubectl get all Jul 1 08:30:10 internal-jumper-server LinuxCommandsWazuh: User rihan [1209503]: 24 ls Jul 1 08:30:12 internal-jumper-server LinuxCommandsWazuh: User rihan [1209503]: 25 ls -al Jul 1 08:30:26 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2000 sudo su rihan Jul 1 08:30:26 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2001 ls Jul 1 08:30:35 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2002 cat rihan2.ovpn Jul 1 08:30:39 internal-jumper-server LinuxCommandsWazuh: message repeated 3 times: [ User ubuntu [1208776]: 2002 cat rihan2.ovpn ] Jul 1 08:30:44 internal-jumper-server LinuxCommandsWazuh: User root [1209853]: 142 exit Jul 1 08:30:47 internal-jumper-server LinuxCommandsWazuh: User root [1209853]: 143 cd /root/ Jul 1 08:30:47 internal-jumper-server LinuxCommandsWazuh: User root [1209853]: 144 ls Jul 1 08:31:00 internal-jumper-server LinuxCommandsWazuh: User root [1209853]: 145 cat rihan Jul 1 08:31:05 internal-jumper-server LinuxCommandsWazuh: User root [1209853]: 146 cat rihan.ovpn Jul 1 08:31:50 internal-jumper-server LinuxCommandsWazuh: User root [1209853]: 146 cat rihan.ovpn Jul 1 08:31:54 internal-jumper-server LinuxCommandsWazuh: User root [1209853]: 147 cat rihan2.ovpn Jul 1 08:32:32 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2003 sudo su Jul 1 08:32:33 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2004 ls Jul 1 08:49:48 internal-jumper-server LinuxCommandsWazuh: User venky [1202333]: 47 kubetail nitrox-dj-7db478b65-8p6ss Jul 1 09:19:00 internal-jumper-server LinuxCommandsWazuh: User venky [1225632]: 48 kubetail nitrox-dj- Jul 1 09:21:47 internal-jumper-server LinuxCommandsWazuh: User venky [1225632]: 48 kubetail nitrox-dj- Jul 1 10:36:39 internal-jumper-server LinuxCommandsWazuh: User rihan [1241752]: 36 ls -al Jul 1 10:36:47 internal-jumper-server LinuxCommandsWazuh: User rihan [1241752]: 37 ls Jul 1 10:39:24 internal-jumper-server LinuxCommandsWazuh: User rihan [1242164]: 37 ls Jul 1 10:39:25 internal-jumper-server LinuxCommandsWazuh: User rihan [1242164]: 37 ls Jul 1 11:02:27 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2005 cd .ssh/ Jul 1 11:02:28 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2006 ls Jul 1 11:02:33 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2007 cat id_rsa Jul 1 11:09:38 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2007 cat id_rsa Jul 1 11:09:38 internal-jumper-server LinuxCommandsWazuh: message repeated 2 times: [ User ubuntu [1208776]: 2007 cat id_rsa] Jul 1 11:09:39 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1208776]: 2008 cd