154100x800000000000000013538851Linux-Sysmon/Operationalar-linux-2022-08-02 12:15:55.377{ec23eae3-157b-62e9-f05c-3f033e560000}30008/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}30006--- 154100x800000000000000012104128Linux-Sysmon/Operationalar-linux-2022-08-02 00:32:45.674{ec23eae3-70ad-62e8-f0bc-151ac9550000}28691/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}28689--- 154100x800000000000000011503330Linux-Sysmon/Operationalar-linux-2022-08-01 19:35:45.675{ec23eae3-2b11-62e8-f03c-b96cfc550000}28208/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}28206--- 154100x80000000000000009638652Linux-Sysmon/Operationalar-linux-2022-08-01 04:12:55.372{ec23eae3-52c7-62e7-f09c-2cdb21560000}26504/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}26502--- 154100x80000000000000006361446Linux-Sysmon/Operationalar-linux-2022-07-31 01:10:55.377{ec23eae3-d69f-62e5-f0cc-425ca6550000}23603/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}23601--- 154100x80000000000000005548854Linux-Sysmon/Operationalar-linux-2022-07-30 18:27:45.676{ec23eae3-7821-62e5-f07c-418b46560000}22972/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}22970--- 154100x80000000000000003793589Linux-Sysmon/Operationalar-linux-2022-07-30 03:26:55.376{ec23eae3-a4ff-62e4-f0cc-242676550000}21392/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}21390--- 154100x80000000000000002718222Linux-Sysmon/Operationalar-linux-2022-07-29 15:10:35.673{ec23eae3-f86b-62e3-f0cc-586da6550000}20190/usr/bin/gawk-----awk $1 == "ii" { print($3); exit(0); }/root{ec23eae3-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}20188--- 154100x80000000000000001346107Linux-Sysmon/Operationalar-linux-2022-07-29 07:39:10.741{ec23eae3-8e9e-62e3-6872-31497a550000}19175/bin/dash-----sh -c /bin/sh/home/ubunturoot{ec23eae3-0000-0000-0000-000001000000}013no level-{ec23eae3-8e9e-62e3-f0ac-c6a2f1550000}19174/usr/bin/gawkawkroot 154100x80000000000000001346106Linux-Sysmon/Operationalar-linux-2022-07-29 07:39:10.739{ec23eae3-8e9e-62e3-f0ac-c6a2f1550000}19174/usr/bin/gawk-----awk BEGIN {system("/bin/sh")}/home/ubunturoot{ec23eae3-0000-0000-0000-000001000000}013no level-{ec23eae3-8e9e-62e3-085e-eb9fb4550000}19173/usr/bin/sudosudoubuntu 154100x80000000000000001346098Linux-Sysmon/Operationalar-linux-2022-07-29 07:39:10.708{ec23eae3-8e9e-62e3-085e-eb9fb4550000}19173/usr/bin/sudo-----sudo awk BEGIN {system("/bin/sh")}/home/ubuntuubuntu{ec23eae3-7de4-62e3-e803-000001000000}100013no level-{ec23eae3-7de4-62e3-48d4-24c63a560000}16485/bin/bash-bashubuntu 154100x80000000000000001339550Linux-Sysmon/Operationalar-linux-2022-07-29 07:36:25.838{ec23eae3-8df9-62e3-9885-6aa7cd550000}19146/usr/bin/apt-----apt install awk/home/ubunturoot{ec23eae3-0000-0000-0000-000001000000}013no level-{ec23eae3-8df9-62e3-08ee-ff09fa550000}19145/usr/bin/sudosudoubuntu 154100x80000000000000001339526Linux-Sysmon/Operationalar-linux-2022-07-29 07:36:25.804{ec23eae3-8df9-62e3-08ee-ff09fa550000}19145/usr/bin/sudo-----sudo apt install awk/home/ubuntuubuntu{ec23eae3-7de4-62e3-e803-000001000000}100013no level-{ec23eae3-7de4-62e3-48d4-24c63a560000}16485/bin/bash-bashubuntu 154100x80000000000000001092052Linux-Sysmon/Operationalar-linux-2022-07-29 06:27:48.404{ec23eae3-7de4-62e3-f0cc-4c6ba6550000}16462/usr/bin/gawk-----awk $5 ~ /^ext(2|3|4)$/ { print $1 }/root{ec23eae3-0000-0000-0000-000000000000}013no level-{00000000-0000-0000-0000-000000000000}16460--- 154100x80000000000000001091864Linux-Sysmon/Operationalar-linux-2022-07-29 06:27:48.377{ec23eae3-7de4-62e3-f02c-372103560000}16458/usr/bin/gawk-----awk {print $1} /proc/uptime/root{ec23eae3-0000-0000-0000-000000000000}013no level-{00000000-0000-0000-0000-000000000000}16457--- 154100x8000000000000000235092Linux-Sysmon/Operationalar-linux-2022-07-29 02:17:24.980{ec23eae3-4334-62e3-f02c-8de41c560000}3207/usr/bin/gawk-----awk $5 ~ /^ext(2|3|4)$/ { print $1 }/root{ec23eae3-0000-0000-0000-000000000000}07no level-{00000000-0000-0000-0000-000000000000}3205--- 154100x8000000000000000235013Linux-Sysmon/Operationalar-linux-2022-07-29 02:17:24.971{ec23eae3-4334-62e3-f0bc-dc5828560000}3203/usr/bin/gawk-----awk {print $1} /proc/uptime/root{ec23eae3-0000-0000-0000-000000000000}07no level-{00000000-0000-0000-0000-000000000000}3202--- 154100x800000000000000089520Linux-Sysmon/Operationalar-linux-2022-07-29 01:33:57.692{ec23eae3-3905-62e3-f04c-32fd8a550000}3040/usr/bin/gawk-----awk {print $1} /proc/uptime/root{ec23eae3-0000-0000-0000-000000000000}05no level-{00000000-0000-0000-0000-000000000000}3039---