type=EXECVE msg=audit(02/20/2025 11:02:58.146:94942): argc=3 a0=sudo a1=touch a2=./.hide_this_data.txt
type=EXECVE msg=audit(02/20/2025 11:02:58.146:94942): argc=2 a0=touch a1=./.hide_this_data.txt