Aug 8 06:48:23 bastion LinuxCommandsWazuh: User ubuntu [111816]: 475 exit Aug 8 06:48:27 bastion LinuxCommandsWazuh: User ubuntu [111816]: 476 cd /etc/records Aug 8 06:48:27 bastion LinuxCommandsWazuh: User ubuntu [111816]: 477 ls Aug 8 06:48:47 bastion LinuxCommandsWazuh: User ubuntu [111816]: 478 d Aug 8 06:48:47 bastion LinuxCommandsWazuh: User ubuntu [111816]: 479 cd Aug 8 06:48:48 bastion LinuxCommandsWazuh: User ubuntu [111816]: 480 ls Aug 8 06:49:02 bastion LinuxCommandsWazuh: User ubuntu [111816]: 481 cd /etc/records Aug 8 06:49:06 bastion LinuxCommandsWazuh: User ubuntu [111816]: 482 cat shobhit_cmd_2024-08-07_23-01-20.log Aug 8 06:49:16 bastion LinuxCommandsWazuh: User ubuntu [111816]: 483 cat ubuntu_cmd_2024-08-08_06-48-23.log Aug 8 06:49:17 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ubuntu [111816]: 483 cat ubuntu_cmd_2024-08-08_06-48-23.log ] Aug 8 06:49:27 bastion LinuxCommandsWazuh: User ubuntu [111816]: 484 crontab -w Aug 8 06:50:00 bastion LinuxCommandsWazuh: User ubuntu [111816]: 485 crontab -e Aug 8 06:50:16 bastion LinuxCommandsWazuh: User ubuntu [111816]: 485 crontab -e Aug 8 06:50:25 bastion LinuxCommandsWazuh: User ubuntu [111816]: 486 cd /var/log/ Aug 8 06:50:26 bastion LinuxCommandsWazuh: User ubuntu [111816]: 487 ls Aug 8 06:50:34 bastion LinuxCommandsWazuh: User ubuntu [111816]: 488 cat syslog Aug 8 07:47:32 bastion LinuxCommandsWazuh: User ubuntu [111816]: 488 cat syslog Aug 8 07:47:33 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ubuntu [111816]: 488 cat syslog] Aug 8 08:29:36 bastion LinuxCommandsWazuh: User ubuntu [113004]: 489 exit Aug 8 08:29:37 bastion LinuxCommandsWazuh: User ubuntu [113004]: 490 ls Aug 8 08:29:41 bastion LinuxCommandsWazuh: User devesh [113027]: 26 exit Aug 8 08:29:41 bastion LinuxCommandsWazuh: User devesh [113027]: 27 ls Aug 8 08:29:42 bastion LinuxCommandsWazuh: User devesh [113027]: 28 cd Aug 8 08:29:42 bastion LinuxCommandsWazuh: User devesh [113027]: 29 ls Aug 8 08:29:46 bastion LinuxCommandsWazuh: User devesh [113027]: 30 cd .ssh/ Aug 8 08:29:46 bastion LinuxCommandsWazuh: User devesh [113027]: 31 ls Aug 8 08:29:49 bastion LinuxCommandsWazuh: User devesh [113027]: 31 ls Aug 8 08:30:29 bastion LinuxCommandsWazuh: User devesh [113027]: 31 ls Aug 8 08:32:36 bastion LinuxCommandsWazuh: User devesh [113027]: 32 cookie Aug 8 08:32:39 bastion LinuxCommandsWazuh: User devesh [113027]: 33 queue Aug 8 08:32:44 bastion LinuxCommandsWazuh: User devesh [113027]: 34 queues Aug 8 08:32:50 bastion LinuxCommandsWazuh: User devesh [113027]: 35 mongo Aug 8 08:32:54 bastion LinuxCommandsWazuh: User devesh [113027]: 36 ls Aug 8 08:32:55 bastion LinuxCommandsWazuh: User devesh [113027]: 37 cat authorized_keys Aug 8 08:32:57 bastion LinuxCommandsWazuh: User ubuntu [113004]: 491 sudo su devesh Aug 8 08:33:00 bastion LinuxCommandsWazuh: User devesh [113302]: 38 exit Aug 8 08:33:26 bastion LinuxCommandsWazuh: User devesh [113302]: 39 mongo pixel_v1 Aug 8 08:34:14 bastion LinuxCommandsWazuh: User devesh [113336]: 38 exit Aug 8 08:34:43 bastion LinuxCommandsWazuh: User devesh [113302]: 40 queues Aug 8 08:39:35 bastion LinuxCommandsWazuh: User devesh [113302]: 41 mongo pixel_v1 Aug 8 08:50:28 bastion LinuxCommandsWazuh: User devesh [113757]: 41 mongo pixel_v1 Aug 8 08:52:00 bastion LinuxCommandsWazuh: User devesh [113890]: 41 mongo pixel_v1 Aug 8 08:52:22 bastion LinuxCommandsWazuh: User devesh [113890]: 42 queues Aug 8 08:52:27 bastion LinuxCommandsWazuh: User devesh [113890]: 43 cookie . Aug 8 08:54:16 bastion LinuxCommandsWazuh: User devesh [113336]: 39 queues Aug 8 09:00:21 bastion LinuxCommandsWazuh: User devesh [113757]: 42 queues Aug 8 11:09:44 bastion LinuxCommandsWazuh: User ubuntu [114925]: 491 sudo su devesh Aug 8 11:09:44 bastion LinuxCommandsWazuh: User ubuntu [114925]: 492 ls Aug 8 11:09:46 bastion LinuxCommandsWazuh: User ubuntu [114925]: 493 cd .. Aug 8 11:09:46 bastion LinuxCommandsWazuh: User ubuntu [114925]: 494 ls Aug 8 11:09:49 bastion ubuntu: root@ [114956]: exit [0] Aug 8 11:09:52 bastion ubuntu: root@ [114956]: cd devyanshu/ [0] Aug 8 11:09:52 bastion ubuntu: root@ [114956]: ls [0] Aug 8 11:09:56 bastion ubuntu: root@ [114956]: ls [0] Aug 8 11:09:58 bastion ubuntu: root@ [114956]: cd .ssh/ [0] Aug 8 11:09:59 bastion ubuntu: root@ [114956]: ks [127] Aug 8 11:10:02 bastion ubuntu: root@ [114956]: cd ..ls [1] Aug 8 11:10:04 bastion ubuntu: root@ [114956]: cd .. [0] Aug 8 11:10:05 bastion ubuntu: root@ [114956]: ls [0] Aug 8 11:10:12 bastion ubuntu: root@ [114956]: cat .bashrc [0] Aug 8 11:10:16 bastion LinuxCommandsWazuh: User ubuntu [114925]: 495 sudo su Aug 8 11:10:23 bastion LinuxCommandsWazuh: User devyanshu [115035]: 41 exit Aug 8 11:10:28 bastion LinuxCommandsWazuh: User devyanshu [115035]: 42 internal Aug 8 11:10:32 bastion LinuxCommandsWazuh: User devyanshu [115035]: 43 docker ps Aug 8 11:10:46 bastion LinuxCommandsWazuh: User devyanshu [115035]: 44 cd /home/ubuntu Aug 8 11:10:46 bastion LinuxCommandsWazuh: User devyanshu [115035]: 45 ls Aug 8 11:10:53 bastion LinuxCommandsWazuh: User devyanshu [115035]: 46 sudo su Aug 8 11:13:28 bastion LinuxCommandsWazuh: User devyanshu [115035]: 47 ls Aug 8 11:13:29 bastion LinuxCommandsWazuh: User devyanshu [115035]: 48 cd Aug 8 11:13:31 bastion LinuxCommandsWazuh: User devyanshu [115035]: 49 cd .ssh/ Aug 8 11:13:31 bastion LinuxCommandsWazuh: User devyanshu [115035]: 50 ls Aug 8 11:13:38 bastion LinuxCommandsWazuh: User devyanshu [115035]: 51 ssh-keygen Aug 8 11:13:44 bastion LinuxCommandsWazuh: User devyanshu [115035]: 52 cat /home/devyanshu/.ssh/id_rsa.pub Aug 8 11:16:36 bastion LinuxCommandsWazuh: User devyanshu [115307]: 41 exit Aug 8 11:16:39 bastion LinuxCommandsWazuh: User devyanshu [115307]: 42 jumper Aug 8 11:17:01 bastion LinuxCommandsWazuh: User devyanshu [115307]: 43 vim .bashrc Aug 8 11:19:17 bastion LinuxCommandsWazuh: User devyanshu [115035]: 53 internal Aug 8 11:49:59 bastion LinuxCommandsWazuh: User devesh [115881]: 43 queues Aug 8 11:50:28 bastion LinuxCommandsWazuh: User devesh [115881]: 44 cookie Aug 8 11:51:13 bastion LinuxCommandsWazuh: User devesh [115881]: 45 queues Aug 8 11:53:20 bastion LinuxCommandsWazuh: User devesh [116004]: 43 queues Aug 8 11:58:30 bastion LinuxCommandsWazuh: User devesh [116113]: 43 queues Aug 8 11:58:36 bastion LinuxCommandsWazuh: User devesh [116113]: 44 mongo