type=EXECVE msg=audit(02/20/2025 10:25:25.761:92634) : argc=3 a0=base64 a1=-d a2=enc.txt 
type=EXECVE msg=audit(02/20/2025 10:24:52.272:92569) : argc=3 a0=base64 a1=-d a2=SGVsbG8sIFdvcmxkIQ== 
type=EXECVE msg=audit(02/20/2025 10:23:43.724:92509) : argc=3 a0=base64 a1=-d a2=SGVsbG8sIFdvcmxkIQ== 
type=EXECVE msg=audit(02/20/2025 10:23:34.471:92503) : argc=3 a0=base64 a1=-d a2=SGVsbG8sIFdvcmxkIQ== 
type=EXECVE msg=audit(02/20/2025 10:23:01.493:92461) : argc=3 a0=base64 a1=-d a2=SGVsbG8sIFdvcmxkIQ== 
type=EXECVE msg=audit(02/20/2025 10:01:31.291:53354) : argc=3 a0=grep a1=-qE a2=/setfacl$|/setlock$|/shuf$|/slsh$|/socat$|/soelim$|/softlimit$|/sort$|/sqlite3$|/ss$|/ssh-agent$|/ssh-keygen$|/ssh-keyscan$|/sshpass$|/start-stop-daemon$|/stdbuf$|/strace$|/strings$|/sysctl$|/systemctl$|/tac$|/tail$|/tar$|/taskset$|/tasksh$|/tbl$|/tclsh$|/tdbtool$|/tee$|/telnet$|/terraform$|/tex$|/tftp$|/tic$|/time$|/timeout$|/tmate$|/troff$|/ul$|/unexpand$|/uniq$|/unshare$|/unsquashfs$|/unzip$|/update-alternatives$|/uudecode$|/uuencode$|/vagrant$|/varnishncsa$|/view$|/vigr$|/vim$|/vimdiff$|/vipw$|/w3m$|/watch$|/wc$|/wget$|/whiptail$|/xargs$|/xdotool$|/xelatex$|/xetex$|/xmodmap$|/xmore$|/xxd$|/xz$|/yash$|/zip$|/zsh$|/zsoelim$|/aa-exec$|/aa-exec$|/ab$|/ab$|/agetty$|/agetty$|/alpine$|/alpine$|/ar$|/ar$|/aria2c$|/aria2c$|/arj$|/arj$|/arp$|/arp$|/as$|/as$|/ascii-xfr$|/ascii-xfr$|/ash$|/ash$|/aspell$|/aspell$|/atobm$|/atobm$|/awk$|/awk$|/base32$|/base32$|/base64$|/base64$|/basenc$|/basenc$|/basez$|/basez$|/bash$|/bash$|/batcat$|/batcat$|/bc$|/bc$|/bridge$|/bridge$|/busctl$|/busctl$|/busybox$|/busybox$|/byebug$|/byebug$|/bzip2$|/bzip2$|/cabal$|/cabal$|/capsh$|/capsh$|/cat$|/cat$|/chmod$|/chmod$|/choom$|/choom$|/chown$|/chown$|/chroot$|/chroot$|/clamscan$|/clamscan$|/cmp$|/cmp$|/column$|/column$|/comm$|/comm$|/composer$|/composer$|/cp$|/cp$|/cpio$|/cpio$|/cpulimit$|/cpulimit$|/csh$|/csh$|/csplit$|/csplit$|/csvtool$|/csvtool$|/cupsfilter$|/cupsfilter$|/curl$|/curl$|/cut$|/cut$|/dash$|/dash$|/date$|/date$|/dc$|/dc$|/dd$|/dd$|/debugfs$|/debugfs$|/dialog$|/dialog$|/diff$|/diff$|/dig$|/dig$|/distcc$|/distcc$|/dmsetup$|/dmsetup$|/docker$|/docker$|/dosbox$|/dosbox$ 
type=EXECVE msg=audit(02/20/2025 10:00:51.243:46977) : argc=2 a0=base64 a1=-d