2024-07-08T07:16:35.771971+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 1996 cat makehook.conf 2024-07-08T07:16:36.650429+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 1997 ls 2024-07-08T07:16:40.794337+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 1998 htop 2024-07-08T07:16:42.876625+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 1999 cat M 2024-07-08T07:16:47.952527+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2000 ls 2024-07-08T07:16:50.121912+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2001 cd cookie- 2024-07-08T07:16:52.418410+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2002 cd cookie-cutter/ 2024-07-08T07:16:52.988422+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2003 ls 2024-07-08T07:16:54.395046+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2004 cat Makefile 2024-07-08T07:16:59.557249+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2004 cat Makefile 2024-07-08T07:17:03.033798+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2005 cd 2024-07-08T07:17:04.093136+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2006 cd .. 2024-07-08T07:17:04.482576+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2007 ls 2024-07-08T07:17:10.824890+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2008 sudo su devesh/ 2024-07-08T07:17:13.113672+00:00 cookie-cutter LinuxCommandsWazuh: User devesh [2326927]: 30 sudo su 2024-07-08T07:17:13.611015+00:00 cookie-cutter LinuxCommandsWazuh: User devesh [2326927]: 31 ls 2024-07-08T07:17:14.542691+00:00 cookie-cutter LinuxCommandsWazuh: User devesh [2326927]: 32 cd 2024-07-08T07:17:15.022211+00:00 cookie-cutter LinuxCommandsWazuh: User devesh [2326927]: 33 ls 2024-07-08T07:17:17.103756+00:00 cookie-cutter LinuxCommandsWazuh: User devesh [2326927]: 34 docker ps 2024-07-08T07:17:26.269584+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2009 sudo su devesh 2024-07-08T07:17:27.519314+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2010 ls 2024-07-08T07:17:31.220652+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2011 cd ubuntu/ 2024-07-08T07:17:33.089814+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2012 s=ls 2024-07-08T07:17:33.775625+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2013 ls 2024-07-08T07:18:04.748102+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2014 cd .. 2024-07-08T07:18:05.374793+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2015 ls 2024-07-08T07:18:32.882975+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2016 cd 2024-07-08T07:18:34.645866+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2017 sudo apt install lshell -y 2024-07-08T07:18:44.102608+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2018 sudo apt update -y 2024-07-08T07:18:45.895355+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2019 sudo apt install lshell -y 2024-07-08T07:19:02.380648+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2020 git clone https://github.com/ghantoos/lshell.git 2024-07-08T07:19:14.006408+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2021 cd lshell/; sudo python3 setup.py install --no-compile --install-scripts=/usr/bin/ 2024-07-08T07:19:18.388929+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2022 ls 2024-07-08T07:19:46.707524+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2022 ls 2024-07-08T07:19:48.599560+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2023 cd .. 2024-07-08T07:19:48.966867+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2024 ls 2024-07-08T07:19:59.187015+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2025 rm -rf lshell/ 2024-07-08T07:20:02.671209+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2026 sudo rm -rf lshell/ 2024-07-08T07:20:06.592604+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2042 Writing /usr/local/lib/python3.10/dist-packages/lshell-0.9.18.egg-info 2024-07-08T07:20:13.477302+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2043 ls 2024-07-08T07:20:28.828156+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2045 from distutils.core import setup 2024-07-08T07:20:40.590753+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2046 cd lshell/; sudo python3 setup.py install --no-compile --install-scripts=/usr/bin 2024-07-08T07:20:43.830324+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2047 cd .. 2024-07-08T07:20:44.970133+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2048 cd lshell/; sudo python3 setup.py install --no-compile --install-scripts=/usr/bin 2024-07-08T07:20:47.702563+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2049 cd .. 2024-07-08T07:20:48.761180+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2049 cd .. 2024-07-08T07:20:50.049235+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2050 cd lshell/; sudo python3 setup.py install --no-compile --install-scripts=/usr/bin 2024-07-08T07:20:58.759588+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2050 cd lshell/; sudo python3 setup.py install --no-compile --install-scripts=/usr/bin 2024-07-08T07:21:09.980723+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2051 sudo apt install lshell -y 2024-07-08T07:21:35.420589+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2052 sudo vi /usr/bin/lshell 2024-07-08T07:21:48.929229+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2053 ls 2024-07-08T07:21:52.730268+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2054 cd /etc/ 2024-07-08T07:21:53.158579+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2055 ls 2024-07-08T07:22:26.880512+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2056 sudo vi lshell.conf 2024-07-08T07:22:34.838924+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2057 sudo chsh -s /usr/bin/lshell anshi 2024-07-08T07:23:08.641040+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2058 sudo su anshi 2024-07-08T07:23:09.603560+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2059 /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/lshell/checkconfig.py 2024-07-08T07:23:17.723554+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2060 sudo vi /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/lshell/checkconfig.py 2024-07-08T07:23:36.777631+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2061 sudo vi /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg 2024-07-08T07:23:49.332020+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2062 sudo cd /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/ 2024-07-08T07:23:54.235843+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2062 sudo cd /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/ 2024-07-08T07:24:07.883258+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2063 sudo cd /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg 2024-07-08T07:24:13.936887+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2064 sudo cd /usr/local/lib/python3.11/dist-packages/ 2024-07-08T07:24:46.860678+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2065 cd /usr/local/lib/python3.11/dist-packages/ 2024-07-08T07:24:47.605348+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2066 ls 2024-07-08T07:24:51.346025+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2067 sido vi lshell-0.9.18-py3.11.egg 2024-07-08T07:25:05.126615+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2068 sudo vi lshell-0.9.18-py3.11.egg 2024-07-08T07:25:47.489993+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2068 sudo vi lshell-0.9.18-py3.11.egg 2024-07-08T07:26:01.935239+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2069 sudo nano /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/lshell/checkconfig.py 2024-07-08T07:36:31.803754+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2069 sudo nano /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/lshell/checkconfig.py 2024-07-08T07:36:31.972793+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2069 sudo nano /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/lshell/checkconfig.py 2024-07-08T07:36:32.160736+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2069 sudo nano /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/lshell/checkconfig.py 2024-07-08T07:36:32.279280+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2069 sudo nano /usr/local/lib/python3.11/dist-packages/lshell-0.9.18-py3.11.egg/lshell/checkconfig.py 2024-07-08T07:36:33.979203+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2070 ls 2024-07-08T07:36:34.718871+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2071 cd 2024-07-08T07:36:35.143718+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2072 ls 2024-07-08T07:59:59.446235+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2073 cd 2024-07-08T07:59:59.591079+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2073 cd 2024-07-08T08:00:00.651714+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2074 ls 2024-07-08T08:00:02.763460+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2074 ls 2024-07-08T08:00:05.938748+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2075 s 2024-07-08T08:00:07.102136+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2076 ls 2024-07-08T08:00:13.971883+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2077 cat log.sh 2024-07-08T08:00:25.162293+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2078 cd /var/log/ 2024-07-08T08:00:26.509724+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2079 ls 2024-07-08T08:00:30.855467+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2080 car commands.log 2024-07-08T08:00:34.772097+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:05:44.765631+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:05:46.816522+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:05:48.127038+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:05:48.344907+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:05.348191+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:05.499219+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:05.657937+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:05.818330+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:05.969764+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:06.112887+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:06.249402+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:06.408906+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:06.541657+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:06.703724+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:07.565204+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:09.964676+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:10.250723+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:10.477004+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:11.124500+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2081 cat commands.log 2024-07-08T08:06:21.921725+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2082 sudo su anshi 2024-07-08T08:06:23.950945+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2083 cat commands.log 2024-07-08T08:06:31.226769+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2084 sudo su anshi 2024-07-08T08:06:32.949272+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2085 cat commands.log 2024-07-08T08:06:35.946864+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2086 ls 2024-07-08T08:06:37.290352+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2087 cat commands.log 2024-07-08T08:10:08.697696+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2087 cat commands.log 2024-07-08T08:10:08.852203+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2087 cat commands.log 2024-07-08T08:10:09.355625+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2088 ls 2024-07-08T08:10:09.852929+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2089 cd 2024-07-08T08:10:10.371123+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2090 ls 2024-07-08T08:10:13.245774+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2091 cd /etc/ 2024-07-08T08:10:13.640334+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2092 ls 2024-07-08T08:10:19.377672+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2093 ll 2024-07-08T08:10:21.252402+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2094 ls -al 2024-07-08T08:11:50.958933+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2094 ls -al 2024-07-08T08:11:51.159947+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2094 ls -al 2024-07-08T08:11:51.303307+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2094 ls -al 2024-07-08T08:12:07.129124+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2095 sudo chsh -s /usr/bin/bash anshi 2024-07-08T08:12:09.865444+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 2024-07-08T08:12:24.684307+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 1 sudo vi ~/.bashrc 2024-07-08T08:12:56.535387+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 2 vi ~/.bashrc 2024-07-08T08:13:08.706235+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 3 source ~/.bashrc 2024-07-08T08:13:11.183675+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 4 makedir 2024-07-08T08:13:14.136548+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 5 mkdir 2024-07-08T08:13:17.247720+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 6 mkdir test 2024-07-08T08:13:21.815455+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 7 ls 2024-07-08T08:13:22.391894+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 8 cd 2024-07-08T08:13:22.776760+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: ls 2024-07-08T08:13:25.752833+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 10 mkdir test 2024-07-08T08:13:27.652485+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 11 ls 2024-07-08T08:13:30.505614+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 12 cd test/ 2024-07-08T08:13:33.697022+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 13 cd bin 2024-07-08T08:13:34.049333+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 14 ls 2024-07-08T08:14:26.088368+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 15 cd . 2024-07-08T08:14:27.496802+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 16 cd .. 2024-07-08T08:14:27.819100+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 17 ls 2024-07-08T08:14:30.418897+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 18 rm test/ 2024-07-08T08:14:30.827896+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 19 ls 2024-07-08T08:14:36.204761+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 20 rm -f test/ 2024-07-08T08:14:39.061835+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 21 rm -rf test/ 2024-07-08T08:14:40.225185+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 22 ls 2024-07-08T08:14:42.998184+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 23 cd bin 2024-07-08T08:14:54.168704+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 24 source ~/.bashrc 2024-07-08T08:14:59.734211+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 25 sudo vi ~/.bashrc 2024-07-08T08:15:12.743920+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 26 vi ~/.bashrc 2024-07-08T08:15:14.641283+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 27 source ~/.bashrc 2024-07-08T08:19:19.542488+00:00 cookie-cutter LinuxCommandsWazuh: User anshi [2341966]: 28 sudo vi ~/.bashrc 2024-07-08T08:19:21.056782+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2096 sudo su anshi 2024-07-08T08:19:38.570215+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2097 cat /var/log/commands.log 2024-07-08T08:20:32.889579+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2098 cd 2024-07-08T08:20:35.247064+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2099 cd /etc/ 2024-07-08T08:20:35.628241+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2100 ls 2024-07-08T08:20:54.321949+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2101 sudo vi lshell.conf 2024-07-08T08:21:05.977786+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2102 sudo chsh -s /usr/bin/lshell anshi 2024-07-08T08:21:23.636131+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2103 sudo su anshi 2024-07-08T08:21:24.032489+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2104 ls 2024-07-08T08:21:37.678549+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2105 cd 2024-07-08T08:21:40.153359+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2106 cd /etc/ 2024-07-08T08:21:45.711704+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2107 sudo vi sudo vi lshell.conf 2024-07-08T08:21:54.557020+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2108 sudo vi lshell.conf 2024-07-08T08:21:56.679777+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2109 cat sudo vi lshell.conf 2024-07-08T08:21:59.219635+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2110 q 2024-07-08T08:22:08.693465+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2110 q 2024-07-08T08:22:16.403051+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2111 cat /var/log/lshell/lshell.log 2024-07-08T08:22:42.722124+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2113 sudo chown -R anshi:anshi /var/log/lshell 2024-07-08T08:22:49.647078+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2114 sudo systemctl restart lshell 2024-07-08T08:22:59.207994+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2115 sudo su anshi 2024-07-08T08:23:06.420806+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2116 sudo cat /var/log/lshell 2024-07-08T08:23:13.257044+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2117 sudo ls /var/log/lshell 2024-07-08T08:23:13.936254+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2118 ls 2024-07-08T08:23:17.202983+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2119 sudo ls /var/log/lshell 2024-07-08T08:23:21.927055+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2120 cd /var/log/lshell 2024-07-08T08:23:22.512090+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2121 ls 2024-07-08T08:23:23.615206+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2122 cat anshi.log 2024-07-08T08:23:31.443330+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2123 sudo su anshi 2024-07-08T08:23:44.450994+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2124 sudo chown -R ubuntu:ubuntu /var/log/lshell 2024-07-08T08:23:45.043588+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2125 ls 2024-07-08T08:23:46.346549+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2126 cat anshi.log 2024-07-08T08:23:58.432712+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2127 sudo su anshi 2024-07-08T08:23:59.992584+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2128 cat anshi.log 2024-07-08T08:24:02.514508+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2326739]: 2128 cat anshi.log 2024-07-08T08:24:05.594853+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2345902]: 1996 exit 2024-07-08T08:24:11.557450+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2345902]: 1997 sudo su anshi 2024-07-08T08:24:22.999631+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2345902]: 1998 cd /var/log/lshell/ 2024-07-08T08:24:23.414555+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2345902]: 1999 ls 2024-07-08T08:24:25.354023+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2345902]: 2000 cat anshi.log 2024-07-08T08:24:29.682104+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 1996 exit 2024-07-08T08:25:44.400334+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 1996 exit 2024-07-08T08:25:50.859478+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 1997 sudo groupadd loggroup 2024-07-08T08:25:56.444005+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 1998 sudo usermod -aG sharedgroup ubuntu 2024-07-08T08:26:07.052543+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 1999 sudo usermod -aG loggroup ubuntu 2024-07-08T08:26:10.368803+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2000 sudo usermod -aG loggroup anshi 2024-07-08T08:26:22.609465+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2001 sudo chown -R :loggroup /var/log/lshell 2024-07-08T08:26:33.888045+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2002 sudo chmod -R 770 /var/log/lshell 2024-07-08T08:27:11.355693+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2003 cat anshi.log 2024-07-08T08:27:13.234357+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2004 ls 2024-07-08T08:27:20.441564+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2005 cd /var/log/lshell/ 2024-07-08T08:27:20.864060+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2006 ls 2024-07-08T08:27:22.665899+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2007 cat anshi.log 2024-07-08T08:27:30.882697+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2008 sudo su anshi 2024-07-08T08:27:32.382129+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2009 cat anshi.log 2024-07-08T08:28:55.218461+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2010 cd 2024-07-08T08:29:09.802568+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2011 sudo vi /etc/lshell.conf 2024-07-08T08:29:21.743057+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2012 sudo systemctl restart lshell 2024-07-08T08:29:30.870706+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2013 cd /var/log/lshell/ 2024-07-08T08:29:31.282996+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2014 ls 2024-07-08T08:29:38.894848+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2015 sudo su anshi 2024-07-08T08:29:42.186339+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2016 cat anshi.log 2024-07-08T08:30:06.754572+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2017 sudo su anshi 2024-07-08T08:30:07.980013+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2018 cat anshi.log 2024-07-08T08:45:28.074435+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2018 cat anshi.log 2024-07-08T08:45:28.275766+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2018 cat anshi.log 2024-07-08T08:45:28.410014+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2018 cat anshi.log 2024-07-08T08:46:04.802799+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2019 cd 2024-07-08T08:46:10.033964+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2020 sudo su anshi 2024-07-08T08:46:10.490623+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2021 ls 2024-07-08T08:46:14.276646+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2022 cd /etc/ 2024-07-08T08:46:28.608912+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2023 sudo vi lshell.conf 2024-07-08T08:47:15.466209+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2023 sudo vi lshell.conf 2024-07-08T08:47:18.633222+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2024 sudo su anshi 2024-07-08T08:47:34.554533+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2025 sudo vi lshell.conf 2024-07-08T08:47:48.280594+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2025 sudo vi lshell.conf 2024-07-08T08:48:09.448526+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2026 sudo su anshi 2024-07-08T08:48:11.161101+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2027 cd 2024-07-08T08:48:11.663410+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2028 ls 2024-07-08T08:48:12.572960+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2029 cd 2024-07-08T08:48:25.640151+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2030 cd /etc/ 2024-07-08T08:48:26.022927+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2031 ls 2024-07-08T08:48:34.139885+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2032 cat lshell.conf 2024-07-08T09:11:36.937194+00:00 cookie-cutter LinuxCommandsWazuh: User root [1395112]: 14 docker compose logs -f cookie-cutter-queues | grep -i "Limechat POST Res= 33dd74bb-776e-45bf-8067-2e0e445b0491" 2024-07-08T09:11:36.942916+00:00 cookie-cutter LinuxCommandsWazuh: User root [1395112]: 14 docker compose logs -f cookie-cutter-queues | grep -i "Limechat POST Res= 33dd74bb-776e-45bf-8067-2e0e445b0491" 2024-07-08T09:11:36.948087+00:00 cookie-cutter LinuxCommandsWazuh: User root [1395112]: 14 docker compose logs -f cookie-cutter-queues | grep -i "Limechat POST Res= 33dd74bb-776e-45bf-8067-2e0e445b0491" 2024-07-08T09:11:36.953035+00:00 cookie-cutter LinuxCommandsWazuh: User root [1395112]: 14 docker compose logs -f cookie-cutter-queues | grep -i "Limechat POST Res= 33dd74bb-776e-45bf-8067-2e0e445b0491" 2024-07-08T09:11:36.957829+00:00 cookie-cutter LinuxCommandsWazuh: User root [1395112]: 14 docker compose logs -f cookie-cutter-queues | grep -i "Limechat POST Res= 33dd74bb-776e-45bf-8067-2e0e445b0491" 2024-07-08T09:12:58.236732+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 1996 exit 2024-07-08T09:12:58.825632+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 1997 ls 2024-07-08T09:13:00.099639+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 1998 cd cookie- 2024-07-08T09:13:01.010637+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 1999 cd cookie-cutter/ 2024-07-08T09:13:02.896217+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 2000 docker ps 2024-07-08T09:13:19.237395+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 2001 docker logs -f cookie-cutter-cookie-cutter-1 2024-07-08T09:13:20.306006+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 2002 docker ps 2024-07-08T09:13:35.634929+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2361100]: 2002 docker ps 2024-07-08T11:40:35.809721+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2032 cat lshell.conf 2024-07-08T11:40:35.978278+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2032 cat lshell.conf 2024-07-08T11:40:36.172044+00:00 cookie-cutter LinuxCommandsWazuh: User ubuntu [2346149]: 2032 cat lshell.conf 2024-07-08T12:27:35.380991+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 37 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">HIGH INTENT USERS" 2024-07-08T12:27:43.103640+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 38 cd ../ubuntu/cookie-cutter/ 2024-07-08T12:28:01.178736+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 39 docker logs -f cookie-cutter-cookie-cutter-1 2024-07-08T12:31:14.607926+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.202262+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.208916+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.215217+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.221639+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.228106+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.234388+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.240744+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.246966+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.253250+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.259431+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.265488+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.271580+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.277760+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.283828+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.289859+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.296048+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.302203+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.308089+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.314767+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.321518+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.328077+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.334482+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.340619+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.346800+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.353623+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.360264+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.367535+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.373935+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.380448+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.386903+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.393378+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY" 2024-07-08T12:33:37.399710+00:00 cookie-cutter LinuxCommandsWazuh: User rihan [2406408]: 40 docker logs -f cookie-cutter-cookie-cutter-1 | grep ">>CONSENTED_QUERY"