Aug 8 07:47:42 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1982 docker ps Aug 8 07:47:42 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1983 ls Aug 8 07:47:44 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1984 cd .. Aug 8 07:47:45 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1985 ls Aug 8 07:47:54 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 28 exit Aug 8 07:47:55 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 29 ls Aug 8 07:47:56 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 30 cd .ss Aug 8 07:47:57 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 31 ls Aug 8 07:47:57 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 32 cd Aug 8 07:47:58 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 33 ls Aug 8 07:47:59 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 34 cd ..s Aug 8 07:48:01 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 35 cd .ssh/ Aug 8 07:48:01 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 36 ls Aug 8 07:48:05 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 36 ls Aug 8 07:48:06 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 37 cd Aug 8 07:48:07 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 38 ls Aug 8 07:48:09 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 39 cd .. Aug 8 07:48:09 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 40 ls Aug 8 07:48:13 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 41 sido su anshika Aug 8 07:48:19 internal-jumper-server LinuxCommandsWazuh: User anshi [1232853]: 42 sudo su anshika Aug 8 07:48:36 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1986 sudo su anshi Aug 8 07:49:04 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1987 ssh anshika@34.131.11.11 Aug 8 07:49:08 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 153 sudo su devesh Aug 8 07:49:09 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 154 ls Aug 8 07:49:09 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 155 cd Aug 8 07:49:10 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 156 ls Aug 8 07:49:12 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 157 cd .ssh/ Aug 8 07:49:13 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 158 ls Aug 8 07:49:30 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 159 vi authorized_keys Aug 8 07:49:32 internal-jumper-server LinuxCommandsWazuh: User anshika [1234611]: 160 cd Aug 8 07:49:34 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1988 sudo su anshika Aug 8 07:49:35 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1989 ls Aug 8 07:49:38 internal-jumper-server LinuxCommandsWazuh: User devesh [1234936]: 101 exit Aug 8 07:49:42 internal-jumper-server LinuxCommandsWazuh: User devesh [1234936]: 102 cd .ss Aug 8 07:49:44 internal-jumper-server LinuxCommandsWazuh: User devesh [1234936]: 103 cd Aug 8 07:49:45 internal-jumper-server LinuxCommandsWazuh: User devesh [1234936]: 104 ls Aug 8 07:49:46 internal-jumper-server LinuxCommandsWazuh: User devesh [1234936]: 105 cd .ssh/ Aug 8 07:49:58 internal-jumper-server LinuxCommandsWazuh: User devesh [1234936]: 106 sudo vi authorized_keys Aug 8 07:50:00 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1990 sudo su devesh Aug 8 07:50:00 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1991 ls Aug 8 07:50:11 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1992 sudo su rihan/ Aug 8 07:50:12 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 154 make logs Aug 8 07:50:13 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 155 ls Aug 8 07:50:13 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 156 cd Aug 8 07:50:14 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 157 ls Aug 8 07:50:17 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 158 cd .ssh/ Aug 8 07:50:17 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 159 ls Aug 8 07:50:40 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 160 sudo vi authorized_keys Aug 8 07:50:42 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 161 cd Aug 8 07:50:51 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 177 sudo su rihan Aug 8 07:50:52 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 178 ls Aug 8 07:50:52 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 179 cd Aug 8 07:50:52 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 180 ks Aug 8 07:50:53 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 181 ls Aug 8 07:50:55 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 182 cd .ssh/ Aug 8 07:50:56 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 183 ls Aug 8 07:51:12 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 184 sudo vi authorized_keys Aug 8 07:51:21 internal-jumper-server LinuxCommandsWazuh: User venky [1236285]: 174 sudo su anshika Aug 8 07:51:22 internal-jumper-server LinuxCommandsWazuh: User venky [1236285]: 175 cd Aug 8 07:51:22 internal-jumper-server LinuxCommandsWazuh: User venky [1236285]: 176 ls Aug 8 07:51:24 internal-jumper-server LinuxCommandsWazuh: User venky [1236285]: 177 cd .ssh/ Aug 8 07:51:24 internal-jumper-server LinuxCommandsWazuh: User venky [1236285]: 178 ls Aug 8 07:51:34 internal-jumper-server LinuxCommandsWazuh: User venky [1236285]: 179 sudo vi authorized_keys Aug 8 07:55:36 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 185 sudo su venky Aug 8 07:55:39 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 186 cd Aug 8 07:55:39 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 187 ls Aug 8 07:55:40 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 188 cd Aug 8 07:55:40 internal-jumper-server LinuxCommandsWazuh: User shamailtayyab [1235890]: 189 ls Aug 8 07:55:43 internal-jumper-server LinuxCommandsWazuh: User rihan [1235473]: 162 sudo su shamailtayyab Aug 8 07:55:45 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1993 sudo su rihan Aug 8 07:55:47 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1994 cd Aug 8 07:55:49 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1995 cd .ssh/ Aug 8 07:55:49 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1996 ls Aug 8 07:56:54 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1232469]: 1997 sudo vi authorized_keys Aug 8 11:04:26 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1982 exit Aug 8 11:04:29 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1983 cd /etc/nginx/sites-enabled/ Aug 8 11:04:34 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1984 cat anshika.conf Aug 8 11:09:35 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1984 cat anshika.conf Aug 8 11:09:36 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1984 cat anshika.conf Aug 8 11:09:37 internal-jumper-server LinuxCommandsWazuh: message repeated 3 times: [ User ubuntu [1368216]: 1984 cat anshika.conf ] Aug 8 11:11:05 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1984 cat anshika.conf Aug 8 11:11:05 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1984 cat anshika.conf Aug 8 11:11:06 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1984 cat anshika.conf Aug 8 11:11:07 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1985 cd Aug 8 11:11:07 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1986 ls Aug 8 11:11:08 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1987 cd .. Aug 8 11:11:08 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1988 ls Aug 8 11:12:59 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1988 ls Aug 8 11:13:00 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1988 ls Aug 8 11:13:01 internal-jumper-server LinuxCommandsWazuh: message repeated 2 times: [ User ubuntu [1368216]: 1988 ls] Aug 8 11:13:01 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1988 ls Aug 8 11:13:02 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1368216]: 1988 ls Aug 8 11:13:08 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1374684]: Aug 8 11:13:09 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1374684]: 1 ls Aug 8 11:13:15 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1374684]: 2 cd Aug 8 11:13:16 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1374684]: 3 cd .ssh/ Aug 8 11:13:17 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1374684]: 4 ls Aug 8 11:13:18 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1374684]: 5 cat authorized_keys Aug 8 11:14:00 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1374684]: 6 sudo vi authorized_keys Aug 8 11:14:04 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375402]: Aug 8 11:14:06 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375402]: 1 docker ps Aug 8 11:14:37 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375402]: 2 sudo groupadd docker Aug 8 11:14:44 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375402]: 3 sudo usermod -aG docker $USER Aug 8 11:14:48 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375867]: Aug 8 11:14:51 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375867]: 1 docker ps Aug 8 11:17:06 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1377388]: Aug 8 11:17:11 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1377511]: Aug 8 11:17:41 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1377511]: 1 ls Aug 8 11:18:40 internal-jumper-server LinuxCommandsWazuh: User root [1379778]: 206 make psql Aug 8 11:18:47 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375867]: 2 sudo su Aug 8 11:18:51 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375867]: 3 sudo ubuntu Aug 8 11:18:55 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1380170]: 1982 exit Aug 8 11:18:57 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1380170]: 1983 ls Aug 8 11:19:04 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1381511]: 1982 exit Aug 8 11:19:07 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1381511]: 1983 cd Aug 8 11:19:08 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1381511]: 1984 ls Aug 8 11:19:09 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375867]: 4 sudo su ubuntu Aug 8 11:19:10 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375867]: 5 ls Aug 8 11:19:10 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1380170]: 1984 mkdir sir-tunnel Aug 8 11:19:11 internal-jumper-server LinuxCommandsWazuh: User devyanshu [1375402]: 4 newgrp docker Aug 8 11:19:13 internal-jumper-server LinuxCommandsWazuh: User ubuntu [1380170]: 1985 cd sir-tunnel/