Aug 22 05:20:52 bastion LinuxCommandsWazuh: User ubuntu [322578]: 528 sudo su rihan Aug 22 05:20:55 bastion LinuxCommandsWazuh: User ubuntu [322578]: 529 suod su rihan Aug 22 05:20:59 bastion LinuxCommandsWazuh: User rihan [322604]: 54 cookie Aug 22 05:21:00 bastion LinuxCommandsWazuh: User rihan [322604]: 55 cd Aug 22 05:21:02 bastion LinuxCommandsWazuh: User rihan [322604]: 56 cookiw Aug 22 05:21:55 bastion LinuxCommandsWazuh: User ubuntu [322720]: 528 sudo su rihan Aug 22 05:21:59 bastion LinuxCommandsWazuh: User rihan [322733]: 54 cookie Aug 22 08:03:51 bastion LinuxCommandsWazuh: User rihan [322733]: 55 queues Aug 22 08:04:03 bastion LinuxCommandsWazuh: User rihan [322604]: 57 cookie Aug 22 10:31:42 bastion LinuxCommandsWazuh: User devyanshu [335617]: 80 internal Aug 22 10:31:44 bastion LinuxCommandsWazuh: User devyanshu [335692]: 80 internal Aug 22 10:31:46 bastion LinuxCommandsWazuh: User devyanshu [335692]: 81 ls Aug 22 10:36:14 bastion LinuxCommandsWazuh: User devyanshu [335617]: 81 byobu Aug 22 10:51:08 bastion LinuxCommandsWazuh: User devyanshu [343905]: 81 byobu Aug 22 10:51:23 bastion LinuxCommandsWazuh: User devyanshu [335692]: 82 psql Aug 22 11:17:33 bastion LinuxCommandsWazuh: User shamailtayyab [348616]: 49 ssh shamailtayyab@34.131.11.11 Aug 22 11:42:37 bastion LinuxCommandsWazuh: User ubuntu [349050]: 530 sudo su rihan Aug 22 11:42:42 bastion LinuxCommandsWazuh: User shadab [349068]: Aug 22 11:42:43 bastion LinuxCommandsWazuh: User shadab [349068]: 1 cd Aug 22 11:42:43 bastion LinuxCommandsWazuh: User shadab [349068]: 2 ls Aug 22 11:43:26 bastion LinuxCommandsWazuh: User shamailtayyab [348616]: 49 ssh shamailtayyab@34.131.11.11 Aug 22 11:43:31 bastion LinuxCommandsWazuh: User shamailtayyab [348616]: 50 psql Aug 22 11:43:53 bastion LinuxCommandsWazuh: User shadab [349068]: 3 sudo vi ~/.bashrc Aug 22 11:44:00 bastion LinuxCommandsWazuh: User shadab [349068]: 3 sudo vi ~/.bashrc Aug 22 11:44:03 bastion LinuxCommandsWazuh: User shadab [349068]: 4 sudo psql Aug 22 11:44:08 bastion ubuntu: root@ [349178]: exit [0] Aug 22 11:44:10 bastion LinuxCommandsWazuh: User shadab [349068]: 5 sudo su Aug 22 11:44:29 bastion LinuxCommandsWazuh: User shadab [349068]: 6 sudo setfacl -m u:shadab:0 /home/ubuntu Aug 22 11:45:27 bastion LinuxCommandsWazuh: User ubuntu [349050]: 531 sudo su shadab Aug 22 11:45:30 bastion LinuxCommandsWazuh: User rihan [349233]: 58 cookie Aug 22 11:45:34 bastion LinuxCommandsWazuh: User rihan [349233]: 59 sudo su Aug 22 11:45:36 bastion LinuxCommandsWazuh: User ubuntu [349050]: 532 sudo su rihan Aug 22 11:46:44 bastion LinuxCommandsWazuh: User ubuntu [349050]: 533 getent group Aug 22 11:48:30 bastion LinuxCommandsWazuh: User ubuntu [349050]: 533 getent group Aug 22 11:50:18 bastion LinuxCommandsWazuh: User ubuntu [349050]: 534 sudo gpasswd -d shadab google-sudoers Aug 22 11:50:24 bastion LinuxCommandsWazuh: User shadab [349395]: 7 exit Aug 22 11:50:26 bastion LinuxCommandsWazuh: User shadab [349395]: 8 sudo su Aug 22 11:50:36 bastion LinuxCommandsWazuh: User shadab [349395]: psql Aug 22 11:50:38 bastion LinuxCommandsWazuh: User ubuntu [349050]: 535 sudo su shadab Aug 22 11:50:45 bastion LinuxCommandsWazuh: User ubuntu [349050]: 536 psql Aug 22 11:51:00 bastion LinuxCommandsWazuh: User ubuntu [349050]: 537 psql -d tasdeeq_v1 -U postgres Aug 22 11:51:07 bastion LinuxCommandsWazuh: User ubuntu [349050]: 538 psql -d tasdeeq_v2 -U postgres Aug 22 11:51:18 bastion LinuxCommandsWazuh: User ubuntu [349050]: 539 psql -d tasdeeq_v1 -U dbuser Aug 22 11:51:30 bastion LinuxCommandsWazuh: User ubuntu [349050]: 540 psql -d tasdeeq_v1 -U postgres Aug 22 11:52:09 bastion LinuxCommandsWazuh: User ubuntu [349050]: 541 psql -d tasdeeq -U postgres Aug 22 11:52:18 bastion LinuxCommandsWazuh: User ubuntu [349050]: 541 psql -d tasdeeq -U postgres Aug 22 11:52:25 bastion LinuxCommandsWazuh: User shadab [349558]: 10 exit Aug 22 11:52:26 bastion LinuxCommandsWazuh: User shadab [349558]: 11 cd Aug 22 11:52:38 bastion LinuxCommandsWazuh: User shadab [349558]: 12 psql -d tasdeeq -U postgres Aug 22 11:52:45 bastion LinuxCommandsWazuh: User shadab [349558]: 13 internal Aug 22 11:52:51 bastion LinuxCommandsWazuh: User shadab [349558]: 14 cd .ssh/ Aug 22 11:52:52 bastion LinuxCommandsWazuh: User shadab [349558]: 15 ls Aug 22 11:53:00 bastion LinuxCommandsWazuh: User shadab [349558]: 16 ssh-keygen Aug 22 11:53:05 bastion LinuxCommandsWazuh: User shadab [349558]: 17 cat id_rsa.pub Aug 22 11:53:28 bastion LinuxCommandsWazuh: User shadab [349558]: 17 cat id_rsa.pub Aug 22 11:54:09 bastion LinuxCommandsWazuh: User shadab [349558]: 18 internal Aug 22 11:54:11 bastion LinuxCommandsWazuh: User ubuntu [349050]: 542 sudo su shadab Aug 22 11:54:58 bastion LinuxCommandsWazuh: User ubuntu [349764]: 543 exit Aug 22 11:55:57 bastion LinuxCommandsWazuh: User ubuntu [349764]: 543 exit Aug 22 11:57:21 bastion LinuxCommandsWazuh: User ubuntu [349764]: 543 exit Aug 22 11:58:13 bastion LinuxCommandsWazuh: User shadab [349919]: 19 exit Aug 22 12:02:46 bastion LinuxCommandsWazuh: User shamailtayyab [350315]: 49 ssh shamailtayyab@34.131.11.11 Aug 22 12:02:47 bastion LinuxCommandsWazuh: User shamailtayyab [350315]: 50 cd Aug 22 12:02:53 bastion LinuxCommandsWazuh: User shamailtayyab [350315]: 51 psql Aug 22 12:02:59 bastion LinuxCommandsWazuh: message repeated 2 times: [ User shamailtayyab [350315]: 51 psql] Aug 22 12:03:04 bastion LinuxCommandsWazuh: User shamailtayyab [350315]: 52 internal Aug 22 12:08:35 bastion LinuxCommandsWazuh: User shamailtayyab [350315]: 52 internal Aug 22 12:08:36 bastion LinuxCommandsWazuh: message repeated 5 times: [ User shamailtayyab [350315]: 52 internal] Aug 22 12:08:37 bastion LinuxCommandsWazuh: User ubuntu [349764]: 544 sudo su shamailtayyab Aug 22 12:08:38 bastion LinuxCommandsWazuh: User shadab [349919]: 20 psql -d tasdeeq -U postgres Aug 22 12:08:40 bastion LinuxCommandsWazuh: User shadab [349919]: 20 psql -d tasdeeq -U postgres Aug 22 12:40:00 bastion LinuxCommandsWazuh: User ubuntu [350669]: 544 sudo su shamailtayyab Aug 22 12:40:06 bastion LinuxCommandsWazuh: User rihan [350707]: 60 exit Aug 22 12:40:08 bastion LinuxCommandsWazuh: User rihan [350707]: 61 cd Aug 22 12:48:08 bastion LinuxCommandsWazuh: User devesh [350868]: 61 cookie Aug 22 12:48:13 bastion LinuxCommandsWazuh: User rihan [350707]: 62 cookie Aug 22 12:48:15 bastion LinuxCommandsWazuh: User ubuntu [350669]: 545 sudo su rihan Aug 22 13:24:50 bastion LinuxCommandsWazuh: User devesh [350868]: 62 cookie Aug 22 13:32:37 bastion LinuxCommandsWazuh: User devesh [350868]: 63 mongo pixel_v1 Aug 22 13:43:40 bastion LinuxCommandsWazuh: User shamailtayyab [348616]: 51 psql nitrox_v1 Aug 22 13:43:48 bastion LinuxCommandsWazuh: User shamailtayyab [312202]: 49 ssh shamailtayyab@34.131.11.11 Aug 22 16:46:16 bastion LinuxCommandsWazuh: User anshika [352448]: 49 internal Aug 22 16:47:15 bastion LinuxCommandsWazuh: User anshika [352448]: 49 internal Aug 22 16:48:56 bastion LinuxCommandsWazuh: User anshika [352448]: 50 psql