93 lines
1.6 KiB
JSON
93 lines
1.6 KiB
JSON
[
|
|
{
|
|
"timestamp_ns": 1000000000,
|
|
"pid": 1234,
|
|
"ppid": 1000,
|
|
"uid": 1000,
|
|
"gid": 1000,
|
|
"event_type": 1,
|
|
"ret_val": 0,
|
|
"comm": "bash",
|
|
"filename": "/usr/bin/ls",
|
|
"addr_v4": 0,
|
|
"port": 0,
|
|
"protocol": 0,
|
|
"target_uid": 0,
|
|
"target_gid": 0,
|
|
"ptrace_request": 0,
|
|
"target_pid": 0
|
|
},
|
|
{
|
|
"timestamp_ns": 2000000000,
|
|
"pid": 1234,
|
|
"ppid": 1000,
|
|
"uid": 1000,
|
|
"gid": 1000,
|
|
"event_type": 3,
|
|
"ret_val": 0,
|
|
"comm": "python3",
|
|
"filename": "/etc/shadow",
|
|
"addr_v4": 0,
|
|
"port": 0,
|
|
"protocol": 0,
|
|
"target_uid": 0,
|
|
"target_gid": 0,
|
|
"ptrace_request": 0,
|
|
"target_pid": 0
|
|
},
|
|
{
|
|
"timestamp_ns": 3000000000,
|
|
"pid": 5678,
|
|
"ppid": 5600,
|
|
"uid": 1000,
|
|
"gid": 1000,
|
|
"event_type": 10,
|
|
"ret_val": 0,
|
|
"comm": "exploit",
|
|
"filename": "",
|
|
"addr_v4": 0,
|
|
"port": 0,
|
|
"protocol": 0,
|
|
"target_uid": 0,
|
|
"target_gid": 0,
|
|
"ptrace_request": 0,
|
|
"target_pid": 0
|
|
},
|
|
{
|
|
"timestamp_ns": 4000000000,
|
|
"pid": 9999,
|
|
"ppid": 9900,
|
|
"uid": 0,
|
|
"gid": 0,
|
|
"event_type": 6,
|
|
"ret_val": 0,
|
|
"comm": "nc",
|
|
"filename": "",
|
|
"addr_v4": 167772161,
|
|
"port": 4444,
|
|
"protocol": 2,
|
|
"target_uid": 0,
|
|
"target_gid": 0,
|
|
"ptrace_request": 0,
|
|
"target_pid": 0
|
|
},
|
|
{
|
|
"timestamp_ns": 5000000000,
|
|
"pid": 7777,
|
|
"ppid": 7700,
|
|
"uid": 0,
|
|
"gid": 0,
|
|
"event_type": 12,
|
|
"ret_val": 0,
|
|
"comm": "injector",
|
|
"filename": "",
|
|
"addr_v4": 0,
|
|
"port": 0,
|
|
"protocol": 0,
|
|
"target_uid": 0,
|
|
"target_gid": 0,
|
|
"ptrace_request": 16,
|
|
"target_pid": 1234
|
|
}
|
|
]
|