{
  "event": "file_write",
  "pid": 4242,
  "ppid": 1,
  "uid": 1000,
  "comm": "python3",
  "parent_comm": "bash",
  "path": "/etc/systemd/system/evil.service",
  "argv": ["-c", "write unit"]
}