{"name":"es_process_events","hostIdentifier":"ip-172-31-18-170.ca-central-1.compute.internal","calendarTime":"Thu Jul 23 14:48:12 2026 UTC","unixTime":1784818092,"epoch":0,"counter":5831,"numerics":false,"decorations":{"host_uuid":"51C669DA-35AA-5868-AFB4-FA119C54F3BB","username":"ec2-user"},"columns":{"cdhash":"e4a4e2ddcc504a7cd6fa3ff899554740dbd63e8c","child_pid":"","cmdline":"osascript -e \"display dialog \\\"A critical security update is available. Please enter your password to install.\\\" default answer \\\"\\\" with title \\\"Software Update\\\" with icon note with hidden answer\" ","cmdline_count":"3","codesigning_flags":"","cwd":"/Users/ec2-user","egid":"20","env":"TMPDIR=/var/folders/bd/r2ntt3nj3xx3dp_56r5k983m0000gn/T/ __CFBundleIdentifier=com.apple.Terminal XPC_FLAGS=0x0 TERM=xterm-256color SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.vsRFYueKwY/Listeners XPC_SERVICE_NAME=0 TERM_PROGRAM=Apple_Terminal TERM_PROGRAM_VERSION=455.1 TERM_SESSION_ID=C93AF877-AAB1-4B0E-8BA1-1AD2D2B89820 SHELL=/bin/zsh HOME=/Users/ec2-user LOGNAME=ec2-user USER=ec2-user PATH=/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin SHLVL=1 PWD=/Users/ec2-user OLDPWD=/Users/ec2-user/splunkforwarder/bin CLICOLOR=1 HOMEBREW_PREFIX=/opt/homebrew HOMEBREW_CELLAR=/opt/homebrew/Cellar HOMEBREW_REPOSITORY=/opt/homebrew HOMEBREW_SHELLENV_PREFIX=/opt/homebrew MANPATH=/opt/homebrew/share/man:: INFOPATH=/opt/homebrew/share/info: LANG=en_US.UTF-8 _=/usr/bin/osascript ","env_count":"26","euid":"20","event_type":"exec","exit_code":"","gid":"20","global_seq_num":"30259","original_parent":"13029","parent":"13029","parent_pidversion":"36147","path":"/usr/bin/osascript","pid":"13971","pidversion":"38836","platform_binary":"1","responsible_pid":"3085","responsible_pidversion":"7818","seq_num":"15005","session_id":"13028","signing_id":"com.apple.osascript","team_id":"","time":"1784818092","uid":"501","username":"ec2-user","version":"9"},"action":"added"}
{"name":"es_process_events","hostIdentifier":"ip-172-31-18-170.ca-central-1.compute.internal","calendarTime":"Thu Jul 23 14:47:53 2026 UTC","unixTime":1784818073,"epoch":0,"counter":5829,"numerics":false,"decorations":{"host_uuid":"51C669DA-35AA-5868-AFB4-FA119C54F3BB","username":"ec2-user"},"columns":{"cdhash":"e4a4e2ddcc504a7cd6fa3ff899554740dbd63e8c","child_pid":"","cmdline":"osascript -e \"\\x0A    set userInput to text returned of (display dialog \\\"macOS needs to access System Settings\\\" default answer \\\"\\\" with title \\\"System Preferences\\\" with icon caution with hidden answer)\\x0A    set shellCommand to \\\"echo \\\\\\\"Captured hidden input: \\\" & quoted form of userInput & \\\"\\\\\\\" > /tmp/captured_system_settings_input.log\\\"\\x0A    do shell script shellCommand\\x0A\" ","cmdline_count":"3","codesigning_flags":"","cwd":"/Users/ec2-user","egid":"20","env":"TMPDIR=/var/folders/bd/r2ntt3nj3xx3dp_56r5k983m0000gn/T/ __CFBundleIdentifier=com.apple.Terminal XPC_FLAGS=0x0 TERM=xterm-256color SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.vsRFYueKwY/Listeners XPC_SERVICE_NAME=0 TERM_PROGRAM=Apple_Terminal TERM_PROGRAM_VERSION=455.1 TERM_SESSION_ID=C93AF877-AAB1-4B0E-8BA1-1AD2D2B89820 SHELL=/bin/zsh HOME=/Users/ec2-user LOGNAME=ec2-user USER=ec2-user PATH=/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin SHLVL=1 PWD=/Users/ec2-user OLDPWD=/Users/ec2-user/splunkforwarder/bin CLICOLOR=1 HOMEBREW_PREFIX=/opt/homebrew HOMEBREW_CELLAR=/opt/homebrew/Cellar HOMEBREW_REPOSITORY=/opt/homebrew HOMEBREW_SHELLENV_PREFIX=/opt/homebrew MANPATH=/opt/homebrew/share/man:: INFOPATH=/opt/homebrew/share/info: LANG=en_US.UTF-8 _=/usr/bin/osascript ","env_count":"26","euid":"20","event_type":"exec","exit_code":"","gid":"20","global_seq_num":"30240","original_parent":"13029","parent":"13029","parent_pidversion":"36147","path":"/usr/bin/osascript","pid":"13966","pidversion":"38822","platform_binary":"1","responsible_pid":"3085","responsible_pidversion":"7818","seq_num":"14996","session_id":"13028","signing_id":"com.apple.osascript","team_id":"","time":"1784818069","uid":"501","username":"ec2-user","version":"9"},"action":"added"}
{"name":"es_process_events","hostIdentifier":"ip-172-31-18-170.ca-central-1.compute.internal","calendarTime":"Thu Jul 23 14:43:46 2026 UTC","unixTime":1784817826,"epoch":0,"counter":5805,"numerics":false,"decorations":{"host_uuid":"51C669DA-35AA-5868-AFB4-FA119C54F3BB","username":"ec2-user"},"columns":{"cdhash":"e4a4e2ddcc504a7cd6fa3ff899554740dbd63e8c","child_pid":"","cmdline":"osascript -e \"\\x0A    set userInput to text returned of (display dialog \\\"macOS needs to access System Settings\\\" default answer \\\"\\\" with title \\\"System Preferences\\\" with icon caution with hidden answer)\\x0A    set shellCommand to \\\"echo \\\\\\\"Captured hidden input: \\\" & quoted form of userInput & \\\"\\\\\\\" > /tmp/captured_system_settings_input.log\\\"\\x0A    do shell script shellCommand\\x0A\" ","cmdline_count":"3","codesigning_flags":"","cwd":"/Users/ec2-user","egid":"20","env":"TMPDIR=/var/folders/bd/r2ntt3nj3xx3dp_56r5k983m0000gn/T/ __CFBundleIdentifier=com.apple.Terminal XPC_FLAGS=0x0 TERM=xterm-256color SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.vsRFYueKwY/Listeners XPC_SERVICE_NAME=0 TERM_PROGRAM=Apple_Terminal TERM_PROGRAM_VERSION=455.1 TERM_SESSION_ID=C93AF877-AAB1-4B0E-8BA1-1AD2D2B89820 SHELL=/bin/zsh HOME=/Users/ec2-user LOGNAME=ec2-user USER=ec2-user PATH=/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin SHLVL=1 PWD=/Users/ec2-user OLDPWD=/etc CLICOLOR=1 HOMEBREW_PREFIX=/opt/homebrew HOMEBREW_CELLAR=/opt/homebrew/Cellar HOMEBREW_REPOSITORY=/opt/homebrew HOMEBREW_SHELLENV_PREFIX=/opt/homebrew MANPATH=/opt/homebrew/share/man:: INFOPATH=/opt/homebrew/share/info: LANG=en_US.UTF-8 _=/usr/bin/osascript ","env_count":"26","euid":"20","event_type":"exec","exit_code":"","gid":"20","global_seq_num":"29862","original_parent":"13029","parent":"13029","parent_pidversion":"36147","path":"/usr/bin/osascript","pid":"13867","pidversion":"38543","platform_binary":"1","responsible_pid":"3085","responsible_pidversion":"7818","seq_num":"14816","session_id":"13028","signing_id":"com.apple.osascript","team_id":"","time":"1784817824","uid":"501","username":"ec2-user","version":"9"},"action":"added"}