{
  "event": "exec",
  "pid": 4244,
  "ppid": 812,
  "uid": 33,
  "parent_comm": "nginx",
  "filename": "/usr/bin/sh",
  "argv": ["-c", "id"]
}