Aug 25 11:25:38 bastion LinuxCommandsWazuh: User ankur [1820188]: 1594 exit Aug 25 11:52:51 bastion LinuxCommandsWazuh: User ankur [1844861]: 1595 byobu Aug 25 12:03:43 bastion LinuxCommandsWazuh: User ankur [1844861]: 1595 byobu Aug 25 12:25:28 bastion LinuxCommandsWazuh: User ubuntu [1857614]: 1844 exit Aug 25 12:25:31 bastion LinuxCommandsWazuh: User ubuntu [1857614]: 1844 exit Aug 25 12:25:35 bastion LinuxCommandsWazuh: User rihan [1857634]: 1304 mongo Aug 25 12:25:36 bastion LinuxCommandsWazuh: User rihan [1857634]: 1305 cd Aug 25 12:26:13 bastion LinuxCommandsWazuh: User rihan [1857634]: 1306 psql Aug 25 12:26:16 bastion LinuxCommandsWazuh: User rihan [1857634]: 1307 psql -h 10.53.208.3 -U postgres Aug 25 12:26:20 bastion LinuxCommandsWazuh: User ubuntu [1857614]: 1845 sudo su rihan Aug 25 13:17:35 bastion LinuxCommandsWazuh: User rihan [1862531]: 1308 exit Aug 25 13:41:13 bastion LinuxCommandsWazuh: User ankur [1864411]: 1596 exit Aug 25 13:55:40 bastion LinuxCommandsWazuh: User ashish [1878780]: 370 byobu Aug 25 13:55:48 bastion LinuxCommandsWazuh: User ashish [1879488]: 370 byobu Aug 25 13:56:00 bastion LinuxCommandsWazuh: User ankur [1864411]: 1597 byobu Aug 25 14:24:11 bastion LinuxCommandsWazuh: User ubuntu [1895494]: 1846 exit Aug 25 14:24:23 bastion LinuxCommandsWazuh: User ubuntu [1895494]: 1847 mongosh -h 10.8.0.4 Aug 25 14:24:32 bastion LinuxCommandsWazuh: User ubuntu [1895494]: 1848 mongosh -host 10.8.0.4 Aug 25 15:17:48 bastion LinuxCommandsWazuh: User ashish [1900373]: 370 byobu Aug 25 15:17:49 bastion LinuxCommandsWazuh: User ashish [1900373]: 371 ls Aug 25 15:29:34 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1849 exit Aug 25 15:29:36 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1850 ls Aug 25 15:30:48 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1851 ping 10.8.0.4 Aug 25 15:31:40 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1852 ping 10.190.0.50 Aug 25 15:31:45 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1853 mongosh -host 10.190.0.50/ Aug 25 15:31:49 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1854 mongosh -host 10.190.0.50 Aug 25 15:34:50 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1855 curl ip.me Aug 25 15:35:05 bastion LinuxCommandsWazuh: User mohtashim [1901773]: 637 exit Aug 25 15:35:07 bastion LinuxCommandsWazuh: User mohtashim [1901773]: 638 clear Aug 25 15:37:26 bastion LinuxCommandsWazuh: User ak [1902663]: 276 exit Aug 25 15:45:50 bastion LinuxCommandsWazuh: User ak [1903764]: 276 exit Aug 25 15:45:56 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1849 exit Aug 25 15:45:57 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1850 ls Aug 25 15:46:00 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1851 cdls Aug 25 15:46:01 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1851 cdls Aug 25 15:46:01 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1852 cd Aug 25 15:46:02 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1853 ls Aug 25 15:46:04 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1854 cd .. Aug 25 15:46:05 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1855 ls Aug 25 15:46:12 bastion LinuxCommandsWazuh: User Shubham [1903858]: Aug 25 15:46:13 bastion LinuxCommandsWazuh: User Shubham [1903858]: 1 ls Aug 25 15:46:14 bastion LinuxCommandsWazuh: User Shubham [1903858]: 2 cd Aug 25 15:46:14 bastion LinuxCommandsWazuh: User Shubham [1903858]: 3 ls Aug 25 15:46:17 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1856 sudo su Shubham Aug 25 15:47:31 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1857 history Aug 25 15:47:46 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1857 history Aug 25 15:47:53 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1858 sudosu Aug 25 15:47:55 bastion ak: root@ [1903971]: exit [0] Aug 25 15:47:58 bastion ak: root@ [1903971]: history [0] Aug 25 15:53:26 bastion ak: root@ [1903971]: sudo deluser shubham sudo [2] Aug 25 15:53:26 bastion ak: root@ [1903971]: sudo deluser shubham google_sudoers [2] Aug 25 15:53:33 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1859 sudo su Aug 25 15:53:44 bastion LinuxCommandsWazuh: User Shubham [1904233]: 4 exit Aug 25 15:53:50 bastion ak: root@ [1904247]: exit [0] Aug 25 15:53:56 bastion ak: root@ [1904247]: sudo deluser Shubham google_sudoers [3] Aug 25 15:54:22 bastion ak: root@ [1904247]: sudo deluser Shubham sudo [6] Aug 25 15:54:27 bastion LinuxCommandsWazuh: User Shubham [1904233]: 5 sudo su Aug 25 15:54:28 bastion ak: root@ [1904290]: exit [0] Aug 25 15:54:30 bastion LinuxCommandsWazuh: User Shubham [1904233]: 5 sudo su Aug 25 15:54:43 bastion LinuxCommandsWazuh: User Shubham [1904233]: 6 getent group recordusers Aug 25 15:54:55 bastion LinuxCommandsWazuh: User Shubham [1904233]: 6 getent group recordusers Aug 25 15:55:08 bastion LinuxCommandsWazuh: User Shubham [1904233]: 7 sudo usermod -aG recordusers ubuntu Aug 25 15:55:11 bastion LinuxCommandsWazuh: User Shubham [1904233]: 8 getent group recordusers Aug 25 15:55:36 bastion LinuxCommandsWazuh: User Shubham [1904233]: sudo usermod -aG recordusers shubham Aug 25 15:55:45 bastion LinuxCommandsWazuh: User Shubham [1904233]: 10 sudo usermod -aG recordusers Shubham Aug 25 15:55:49 bastion ak: root@ [1904744]: exit [0] Aug 25 15:55:51 bastion LinuxCommandsWazuh: User Shubham [1904233]: 11 sudo su Aug 25 15:55:52 bastion LinuxCommandsWazuh: User Shubham [1904233]: 12 cd Aug 25 15:55:52 bastion LinuxCommandsWazuh: User Shubham [1904233]: 13 ls Aug 25 15:56:00 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1860 sudo su Shubham Aug 25 15:56:02 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1861 ls Aug 25 15:56:06 bastion LinuxCommandsWazuh: User abhijeet [1905058]: 1999 internal-server Aug 25 15:56:20 bastion LinuxCommandsWazuh: User abhijeet [1905058]: 2000 sudo usermod -aG recordusers abhijeet Aug 25 15:56:21 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1862 sudo su abhijeet Aug 25 15:56:24 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1863 ls Aug 25 15:56:27 bastion LinuxCommandsWazuh: User aman [1905104]: 192 exit Aug 25 15:56:38 bastion LinuxCommandsWazuh: User aman [1905104]: 193 sudo usermod -aG recordusers aman Aug 25 15:56:41 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1864 sudo su aman Aug 25 15:56:45 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1865 sudo usermod -aG recordusers aman Aug 25 15:56:45 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1866 ls Aug 25 15:56:53 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1867 sudo usermod -aG recordusers ashish Aug 25 15:56:57 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1868 sudo usermod -aG recordusers ayush Aug 25 15:57:10 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1869 sudo usermod -aG recordusers venky Aug 25 15:57:28 bastion LinuxCommandsWazuh: User Shubham [1905214]: 14 exit Aug 25 15:57:29 bastion LinuxCommandsWazuh: User Shubham [1905214]: 15 ls Aug 25 15:57:30 bastion LinuxCommandsWazuh: User Shubham [1905214]: 16 cd Aug 25 15:57:30 bastion LinuxCommandsWazuh: User Shubham [1905214]: 17 ls Aug 25 15:58:04 bastion LinuxCommandsWazuh: User Shubham [1905214]: 17 ls Aug 25 15:58:10 bastion LinuxCommandsWazuh: User Shubham [1905214]: 18 groups Shubham Aug 25 15:58:30 bastion LinuxCommandsWazuh: User Shubham [1905214]: 19 sudo deluser Shubham sudo Aug 25 15:58:39 bastion LinuxCommandsWazuh: User Shubham [1905214]: 20 sudo deluser Shubham google-sudoers Aug 25 15:58:42 bastion ak: root@ [1905297]: exit [0] Aug 25 15:59:19 bastion ak: root@ [1905297]: sudo -l -U Shubham [0] Aug 25 15:59:24 bastion LinuxCommandsWazuh: User Shubham [1905214]: 21 sudo su Aug 25 15:59:25 bastion LinuxCommandsWazuh: User Shubham [1905214]: 22 sudo -l -U Shubham Aug 25 16:00:39 bastion LinuxCommandsWazuh: User Shubham [1905214]: 23 sudo grep -R "Shubham" /etc/sudoers /etc/sudoers.d/ Aug 25 16:00:53 bastion LinuxCommandsWazuh: User Shubham [1905214]: 24 sudo -l -U Shubham Aug 25 16:00:55 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1870 sudo su Shubham Aug 25 16:01:00 bastion LinuxCommandsWazuh: User ashish [1905557]: 370 byobu Aug 25 16:01:02 bastion LinuxCommandsWazuh: User ashish [1905557]: 371 history Aug 25 16:01:27 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1871 sudo su ashish Aug 25 16:01:29 bastion LinuxCommandsWazuh: User Shubham [1905585]: 25 exit Aug 25 16:01:32 bastion LinuxCommandsWazuh: User Shubham [1905585]: 26 sudo su Aug 25 16:01:34 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1872 sudo su Shubham Aug 25 16:01:35 bastion LinuxCommandsWazuh: User Shubham [1905610]: 27 exit Aug 25 16:01:36 bastion LinuxCommandsWazuh: User Shubham [1905610]: 28 cd Aug 25 16:01:37 bastion LinuxCommandsWazuh: User Shubham [1905610]: 29 ls Aug 25 16:01:40 bastion LinuxCommandsWazuh: User Shubham [1905610]: 30 cd .. Aug 25 16:01:40 bastion LinuxCommandsWazuh: User Shubham [1905610]: 31 ls Aug 25 16:01:44 bastion LinuxCommandsWazuh: User Shubham [1905610]: 32 cd aman/ Aug 25 16:01:46 bastion LinuxCommandsWazuh: User Shubham [1905610]: 33 ls Aug 25 16:01:47 bastion LinuxCommandsWazuh: User Shubham [1905610]: 34 cd .. Aug 25 16:01:47 bastion LinuxCommandsWazuh: User Shubham [1905610]: 35 ls Aug 25 16:01:49 bastion LinuxCommandsWazuh: User Shubham [1905610]: 36 cd Aug 25 16:01:49 bastion LinuxCommandsWazuh: User Shubham [1905610]: 37 ls Aug 25 16:02:11 bastion LinuxCommandsWazuh: User abhijeet [1905766]: 1999 exit Aug 25 16:02:16 bastion LinuxCommandsWazuh: User ayush [1905781]: 360 exit Aug 25 16:02:18 bastion LinuxCommandsWazuh: User ayush [1905781]: 361 cd Aug 25 16:04:49 bastion LinuxCommandsWazuh: User Shubham [1905610]: 37 ls Aug 25 16:04:55 bastion LinuxCommandsWazuh: User Shubham [1905610]: 38 sudo su ubuntu Aug 25 16:04:55 bastion LinuxCommandsWazuh: User Shubham [1905610]: 38 sudo su ubuntu Aug 25 16:04:56 bastion LinuxCommandsWazuh: User Shubham [1905610]: 39 ls Aug 25 16:04:59 bastion LinuxCommandsWazuh: User Shubham [1905610]: 40 cd .. Aug 25 16:05:00 bastion LinuxCommandsWazuh: User Shubham [1905610]: 41 ls Aug 25 16:05:01 bastion LinuxCommandsWazuh: User Shubham [1905610]: 42 cd .. Aug 25 16:05:01 bastion LinuxCommandsWazuh: User Shubham [1905610]: 43 ls Aug 25 16:05:02 bastion LinuxCommandsWazuh: User Shubham [1905610]: 44 cd Aug 25 16:05:02 bastion LinuxCommandsWazuh: User Shubham [1905610]: 45 ls Aug 25 16:05:19 bastion LinuxCommandsWazuh: User ubuntu [1903787]: 1872 sudo su Shubham Aug 25 16:05:21 bastion LinuxCommandsWazuh: User ak [1903764]: 277 sudo su ubuntu Aug 25 16:22:13 bastion LinuxCommandsWazuh: User ashish [1908345]: 374 redis Aug 25 16:22:23 bastion LinuxCommandsWazuh: User ashish [1879488]: 371 redis Aug 25 16:22:24 bastion LinuxCommandsWazuh: User ashish [1908345]: 375 byobu Aug 25 16:22:25 bastion LinuxCommandsWazuh: User ashish [1908345]: 375 byobu Aug 25 16:22:25 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [1908345]: 375 byobu] Aug 25 16:22:27 bastion LinuxCommandsWazuh: User ashish [1908345]: 376 bybou Aug 25 16:22:32 bastion LinuxCommandsWazuh: User ashish [1908682]: 375 redis Aug 25 16:23:06 bastion LinuxCommandsWazuh: User ashish [1908682]: 376 mongo Aug 25 16:23:06 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [1908682]: 376 mongo] Aug 25 16:23:07 bastion LinuxCommandsWazuh: User ashish [1908682]: 376 mongo Aug 25 16:23:07 bastion LinuxCommandsWazuh: User ashish [1908682]: 376 mongo Aug 25 16:23:07 bastion LinuxCommandsWazuh: User ashish [1908682]: 376 mongo Aug 25 16:23:11 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ashish [1908682]: 376 mongo] Aug 25 16:23:13 bastion LinuxCommandsWazuh: User ashish [1908682]: 377 clear Aug 25 16:23:26 bastion LinuxCommandsWazuh: User ashish [1908682]: 377 clear Aug 25 16:30:19 bastion LinuxCommandsWazuh: User ubuntu [1901365]: 1855 curl ip.me Aug 25 16:30:20 bastion LinuxCommandsWazuh: message repeated 4 times: [ User ubuntu [1901365]: 1855 curl ip.me] Aug 25 16:31:12 bastion LinuxCommandsWazuh: User ayush [1905781]: 362 cool-server Aug 25 16:31:13 bastion LinuxCommandsWazuh: User abhijeet [1905766]: 2000 sudo su ayush Aug 25 16:34:55 bastion LinuxCommandsWazuh: User abhijeet [1921439]: 1999 exit Aug 25 16:39:11 bastion LinuxCommandsWazuh: User mohtashim [1901773]: 639 psql -h 10.94.16.3 -U postgres -d vortex_v2 Aug 25 16:44:30 bastion LinuxCommandsWazuh: User mohtashim [1931273]: 640 exit Aug 25 17:44:28 bastion LinuxCommandsWazuh: User ashish [1940226]: 378 byobu Aug 25 17:46:33 bastion LinuxCommandsWazuh: User ashish [1940226]: 379 mongo Aug 25 18:54:06 bastion LinuxCommandsWazuh: User mohtashim [1931273]: 641 make cookie-bash Aug 25 20:17:11 bastion LinuxCommandsWazuh: User ayush [1954115]: 363 exit Aug 25 23:02:33 bastion LinuxCommandsWazuh: User ayush [1968176]: 364 cool-server