type=EXECVE msg=audit(02/20/2025 13:08:23.630:145876) : argc=3 a0=grep a1=-Ev a2=.Xauthority|.bashrc|.bluemix|.boto|.cer|.cloudflared|.credentials.json|.crt|.csr|.db|.der|.docker|.env|.erlang.cookie|.flyrc|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.keytab|.kube|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.password-store|.pem|.pfx|.pgp|.plan|.profile|.psk|.pub|.pypirc|.rdg|.recently-used.xbel|.rhosts|.roadtools_auth|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.tf|.tfstate|.timer|.vault-token|.vhd|.vhdx|.viminfo|.vmdk|.vnc|.wgetrc 
type=EXECVE msg=audit(02/20/2025 13:08:23.630:145876) : argc=3 a0=grep a1=-Ev a2=.Xauthority|.bashrc|.bluemix|.boto|.cer|.cloudflared|.credentials.json|.crt|.csr|.db|.der|.docker|.env|.erlang.cookie|.flyrc|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.keytab|.kube|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.password-store|.pem|.pfx|.pgp|.plan|.profile|.psk|.pub|.pypirc|.rdg|.recently-used.xbel|.rhosts|.roadtools_auth|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.tf|.tfstate|.timer|.vault-token|.vhd|.vhdx|.viminfo|.vmdk|.vnc|.wgetrc 
type=EXECVE msg=audit(02/20/2025 13:07:05.666:110401) : argc=73 a0=grep a1=-L a2="\|'\|( a3=/etc/pollinate/entropy.ubuntu.com.pem a4=/etc/ssl/certs/ACCVRAIZ1.pem a5=/etc/ssl/certs/AC_RAIZ_FNMT-RCM.pem a6=/etc/ssl/certs/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.pem a7=/etc/ssl/certs/ANF_Secure_Server_Root_CA.pem a8=/etc/ssl/certs/Actalis_Authentication_Root_CA.pem a9=/etc/ssl/certs/AffirmTrust_Commercial.pem a10=/etc/ssl/certs/AffirmTrust_Networking.pem a11=/etc/ssl/certs/AffirmTrust_Premium.pem a12=/etc/ssl/certs/AffirmTrust_Premium_ECC.pem a13=/etc/ssl/certs/Amazon_Root_CA_1.pem a14=/etc/ssl/certs/Amazon_Root_CA_2.pem a15=/etc/ssl/certs/Amazon_Root_CA_3.pem a16=/etc/ssl/certs/Amazon_Root_CA_4.pem a17=/etc/ssl/certs/Atos_TrustedRoot_2011.pem a18=/etc/ssl/certs/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.pem a19=/etc/ssl/certs/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.pem a20=/etc/ssl/certs/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem a21=/etc/ssl/certs/BJCA_Global_Root_CA1.pem a22=/etc/ssl/certs/BJCA_Global_Root_CA2.pem a23=/etc/ssl/certs/Baltimore_CyberTrust_Root.pem a24=/etc/ssl/certs/Buypass_Class_2_Root_CA.pem a25=/etc/ssl/certs/Buypass_Class_3_Root_CA.pem a26=/etc/ssl/certs/CA_Disig_Root_R2.pem a27=/etc/ssl/certs/CFCA_EV_ROOT.pem a28=/etc/ssl/certs/COMODO_Certification_Authority.pem a29=/etc/ssl/certs/COMODO_ECC_Certification_Authority.pem a30=/etc/ssl/certs/COMODO_RSA_Certification_Authority.pem a31=/etc/ssl/certs/Certainly_Root_E1.pem a32=/etc/ssl/certs/Certainly_Root_R1.pem a33=/etc/ssl/certs/Certigna.pem a34=/etc/ssl/certs/Certigna_Root_CA.pem a35=/etc/ssl/certs/Certum_EC-384_CA.pem a36=/etc/ssl/certs/Certum_Trusted_Network_CA.pem a37=/etc/ssl/certs/Certum_Trusted_Network_CA_2.pem a38=/etc/ssl/certs/Certum_Trusted_Root_CA.pem a39=/etc/ssl/certs/CommScope_Public_Trust_ECC_Root-01.pem a40=/etc/ssl/certs/CommScope_Public_Trust_ECC_Root-02.pem a41=/etc/ssl/certs/CommScope_Public_Trust_RSA_Root-01.pem a42=/etc/ssl/certs/CommScope_Public_Trust_RSA_Root-02.pem a43=/etc/ssl/certs/Comodo_AAA_Services_root.pem a44=/etc/ssl/certs/D-TRUST_BR_Root_CA_1_2020.pem a45=/etc/ssl/certs/D-TRUST_EV_Root_CA_1_2020.pem a46=/etc/ssl/certs/D-TRUST_Root_Class_3_CA_2_2009.pem a47=/etc/ssl/certs/D-TRUST_Root_Class_3_CA_2_EV_2009.pem a48=/etc/ssl/certs/DigiCert_Assured_ID_Root_CA.pem a49=/etc/ssl/certs/DigiCert_Assured_ID_Root_G2.pem a50=/etc/ssl/certs/DigiCert_Assured_ID_Root_G3.pem a51=/etc/ssl/certs/DigiCert_Global_Root_CA.pem a52=/etc/ssl/certs/DigiCert_Global_Root_G2.pem a53=/etc/ssl/certs/DigiCert_Global_Root_G3.pem a54=/etc/ssl/certs/DigiCert_High_Assurance_EV_Root_CA.pem a55=/etc/ssl/certs/DigiCert_TLS_ECC_P384_Root_G5.pem a56=/etc/ssl/certs/DigiCert_TLS_RSA4096_Root_G5.pem a57=/etc/ssl/certs/DigiCert_Trusted_Root_G4.pem a58=/etc/ssl/certs/Entrust.net_Premium_2048_Secure_Server_CA.pem a59=/etc/ssl/certs/Entrust_Root_Certification_Authority.pem a60=/etc/ssl/certs/Entrust_Root_Certification_Authority_-_EC1.pem a61=/etc/ssl/certs/Entrust_Root_Certification_Authority_-_G2.pem a62=/etc/ssl/certs/Entrust_Root_Certification_Authority_-_G4.pem a63=/etc/ssl/certs/GDCA_TrustAUTH_R5_ROOT.pem a64=/etc/ssl/certs/GLOBALTRUST_2020.pem a65=/etc/ssl/certs/GTS_Root_R1.pem a66=/etc/ssl/certs/GTS_Root_R2.pem a67=/etc/ssl/certs/GTS_Root_R3.pem a68=/etc/ssl/certs/GTS_Root_R4.pem a69=/etc/ssl/certs/GlobalSign_ECC_Root_CA_-_R4.pem a70=/etc/ssl/certs/GlobalSign_ECC_Root_CA_-_R5.pem a71=/etc/ssl/certs/GlobalSign_Root_CA.pem a72=/etc/ssl/certs/GlobalSign_Root_CA_-_R3.pem 
type=EXECVE msg=audit(02/20/2025 13:07:05.119:110334) : argc=3 a0=grep a1=-E a2=\.gpg$ 
type=EXECVE msg=audit(02/20/2025 13:07:05.115:110333) : argc=3 a0=grep a1=-E a2=\.gpg$ 
type=EXECVE msg=audit(02/20/2025 13:07:05.111:110332) : argc=3 a0=grep a1=-E a2=\.pgp$ 
type=EXECVE msg=audit(02/20/2025 13:07:05.107:110331) : argc=3 a0=grep a1=-E a2=\.pgp$ 
type=EXECVE msg=audit(02/20/2025 13:07:04.048:110165) : argc=3 a0=grep a1=-E a2=master\.key$ 
type=EXECVE msg=audit(02/20/2025 13:07:04.045:110164) : argc=3 a0=grep a1=-E a2=master\.key$ 
type=EXECVE msg=audit(02/20/2025 13:07:03.932:110153) : argc=3 a0=grep a1=-E a2=\.keystore$ 
type=EXECVE msg=audit(02/20/2025 13:07:03.928:110152) : argc=3 a0=grep a1=-E a2=\.keystore$ 
type=EXECVE msg=audit(02/20/2025 13:07:03.925:110151) : argc=3 a0=grep a1=-E a2=\.keyring$ 
type=EXECVE msg=audit(02/20/2025 13:07:03.922:110150) : argc=3 a0=grep a1=-E a2=\.keyring$ 
type=EXECVE msg=audit(02/20/2025 13:06:41.102:105926) : argc=3 a0=grep a1=-E a2=.*password.*$|.*credential.*$|creds.*$|.*\.key$ 
type=EXECVE msg=audit(02/20/2025 13:06:41.017:105911) : argc=3 a0=grep a1=-E a2=master\.key$|hudson\.util\.Secret$|credentials\.xml$|config\.xml$|.*jenkins$ 
type=EXECVE msg=audit(02/20/2025 13:06:40.405:105825) : argc=3 a0=grep a1=-E a2=.*\.pgp$|.*\.gpg$|.*\.gnupg$ 
type=EXECVE msg=audit(02/20/2025 13:06:40.273:105807) : argc=3 a0=grep a1=-E a2=keyrings$|.*\.keyring$|.*\.keystore$|.*\.jks$ 
type=EXECVE msg=audit(02/20/2025 13:06:40.024:105769) : argc=3 a0=grep a1=-E a2=krb5\.conf$|.*\.keytab$|\.k5login$|krb5cc_.*$|kadm5\.acl$|secrets\.ldb$|\.secrets\.mkey$|sssd\.conf$ 
type=EXECVE msg=audit(02/20/2025 13:06:39.935:105755) : argc=3 a0=grep a1=-E a2=.*\.pfx$|.*\.p12$ 
type=EXECVE msg=audit(02/20/2025 13:06:39.906:105748) : argc=3 a0=grep a1=-E a2=.*\.pem$|.*\.cer$|.*\.crt$ 
type=EXECVE msg=audit(02/20/2025 13:06:39.796:105727) : argc=3 a0=grep a1=-E a2=glusterfs\.pem$|glusterfs\.ca$|glusterfs\.key$ 
type=EXECVE msg=audit(02/20/2025 10:02:49.268:88345) : argc=3 a0=grep a1=-Ev a2=.Xauthority|.bashrc|.bluemix|.boto|.cer|.cloudflared|.credentials.json|.crt|.csr|.db|.der|.docker|.env|.erlang.cookie|.flyrc|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.keytab|.kube|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.password-store|.pem|.pfx|.pgp|.plan|.profile|.psk|.pub|.pypirc|.rdg|.recently-used.xbel|.rhosts|.roadtools_auth|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.tf|.tfstate|.timer|.vault-token|.vhd|.vhdx|.viminfo|.vmdk|.vnc|.wgetrc 
type=EXECVE msg=audit(02/20/2025 10:01:26.932:51629) : argc=73 a0=grep a1=-L a2="\|'\|( a3=/etc/pollinate/entropy.ubuntu.com.pem a4=/etc/ssl/certs/ACCVRAIZ1.pem a5=/etc/ssl/certs/AC_RAIZ_FNMT-RCM.pem a6=/etc/ssl/certs/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.pem a7=/etc/ssl/certs/ANF_Secure_Server_Root_CA.pem a8=/etc/ssl/certs/Actalis_Authentication_Root_CA.pem a9=/etc/ssl/certs/AffirmTrust_Commercial.pem a10=/etc/ssl/certs/AffirmTrust_Networking.pem a11=/etc/ssl/certs/AffirmTrust_Premium.pem a12=/etc/ssl/certs/AffirmTrust_Premium_ECC.pem a13=/etc/ssl/certs/Amazon_Root_CA_1.pem a14=/etc/ssl/certs/Amazon_Root_CA_2.pem a15=/etc/ssl/certs/Amazon_Root_CA_3.pem a16=/etc/ssl/certs/Amazon_Root_CA_4.pem a17=/etc/ssl/certs/Atos_TrustedRoot_2011.pem a18=/etc/ssl/certs/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.pem a19=/etc/ssl/certs/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.pem a20=/etc/ssl/certs/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem a21=/etc/ssl/certs/BJCA_Global_Root_CA1.pem a22=/etc/ssl/certs/BJCA_Global_Root_CA2.pem a23=/etc/ssl/certs/Baltimore_CyberTrust_Root.pem a24=/etc/ssl/certs/Buypass_Class_2_Root_CA.pem a25=/etc/ssl/certs/Buypass_Class_3_Root_CA.pem a26=/etc/ssl/certs/CA_Disig_Root_R2.pem a27=/etc/ssl/certs/CFCA_EV_ROOT.pem a28=/etc/ssl/certs/COMODO_Certification_Authority.pem a29=/etc/ssl/certs/COMODO_ECC_Certification_Authority.pem a30=/etc/ssl/certs/COMODO_RSA_Certification_Authority.pem a31=/etc/ssl/certs/Certainly_Root_E1.pem a32=/etc/ssl/certs/Certainly_Root_R1.pem a33=/etc/ssl/certs/Certigna.pem a34=/etc/ssl/certs/Certigna_Root_CA.pem a35=/etc/ssl/certs/Certum_EC-384_CA.pem a36=/etc/ssl/certs/Certum_Trusted_Network_CA.pem a37=/etc/ssl/certs/Certum_Trusted_Network_CA_2.pem a38=/etc/ssl/certs/Certum_Trusted_Root_CA.pem a39=/etc/ssl/certs/CommScope_Public_Trust_ECC_Root-01.pem a40=/etc/ssl/certs/CommScope_Public_Trust_ECC_Root-02.pem a41=/etc/ssl/certs/CommScope_Public_Trust_RSA_Root-01.pem a42=/etc/ssl/certs/CommScope_Public_Trust_RSA_Root-02.pem a43=/etc/ssl/certs/Comodo_AAA_Services_root.pem a44=/etc/ssl/certs/D-TRUST_BR_Root_CA_1_2020.pem a45=/etc/ssl/certs/D-TRUST_EV_Root_CA_1_2020.pem a46=/etc/ssl/certs/D-TRUST_Root_Class_3_CA_2_2009.pem a47=/etc/ssl/certs/D-TRUST_Root_Class_3_CA_2_EV_2009.pem a48=/etc/ssl/certs/DigiCert_Assured_ID_Root_CA.pem a49=/etc/ssl/certs/DigiCert_Assured_ID_Root_G2.pem a50=/etc/ssl/certs/DigiCert_Assured_ID_Root_G3.pem a51=/etc/ssl/certs/DigiCert_Global_Root_CA.pem a52=/etc/ssl/certs/DigiCert_Global_Root_G2.pem a53=/etc/ssl/certs/DigiCert_Global_Root_G3.pem a54=/etc/ssl/certs/DigiCert_High_Assurance_EV_Root_CA.pem a55=/etc/ssl/certs/DigiCert_TLS_ECC_P384_Root_G5.pem a56=/etc/ssl/certs/DigiCert_TLS_RSA4096_Root_G5.pem a57=/etc/ssl/certs/DigiCert_Trusted_Root_G4.pem a58=/etc/ssl/certs/Entrust.net_Premium_2048_Secure_Server_CA.pem a59=/etc/ssl/certs/Entrust_Root_Certification_Authority.pem a60=/etc/ssl/certs/Entrust_Root_Certification_Authority_-_EC1.pem a61=/etc/ssl/certs/Entrust_Root_Certification_Authority_-_G2.pem a62=/etc/ssl/certs/Entrust_Root_Certification_Authority_-_G4.pem a63=/etc/ssl/certs/GDCA_TrustAUTH_R5_ROOT.pem a64=/etc/ssl/certs/GLOBALTRUST_2020.pem a65=/etc/ssl/certs/GTS_Root_R1.pem a66=/etc/ssl/certs/GTS_Root_R2.pem a67=/etc/ssl/certs/GTS_Root_R3.pem a68=/etc/ssl/certs/GTS_Root_R4.pem a69=/etc/ssl/certs/GlobalSign_ECC_Root_CA_-_R4.pem a70=/etc/ssl/certs/GlobalSign_ECC_Root_CA_-_R5.pem a71=/etc/ssl/certs/GlobalSign_Root_CA.pem a72=/etc/ssl/certs/GlobalSign_Root_CA_-_R3.pem 
type=EXECVE msg=audit(02/20/2025 10:01:26.119:51562) : argc=3 a0=grep a1=-E a2=\.gpg$ 
type=EXECVE msg=audit(02/20/2025 10:01:26.115:51561) : argc=3 a0=grep a1=-E a2=\.gpg$ 
type=EXECVE msg=audit(02/20/2025 10:01:26.112:51560) : argc=3 a0=grep a1=-E a2=\.pgp$ 
type=EXECVE msg=audit(02/20/2025 10:01:26.109:51559) : argc=3 a0=grep a1=-E a2=\.pgp$ 
type=EXECVE msg=audit(02/20/2025 10:01:25.134:51389) : argc=3 a0=grep a1=-E a2=master\.key$ 
type=EXECVE msg=audit(02/20/2025 10:01:25.131:51388) : argc=3 a0=grep a1=-E a2=master\.key$ 
type=EXECVE msg=audit(02/20/2025 10:01:25.036:51381) : argc=3 a0=grep a1=-E a2=\.keystore$ 
type=EXECVE msg=audit(02/20/2025 10:01:25.033:51380) : argc=3 a0=grep a1=-E a2=\.keystore$ 
type=EXECVE msg=audit(02/20/2025 10:01:25.029:51379) : argc=3 a0=grep a1=-E a2=\.keyring$ 
type=EXECVE msg=audit(02/20/2025 10:01:25.024:51378) : argc=3 a0=grep a1=-E a2=\.keyring$ 
type=EXECVE msg=audit(02/20/2025 10:00:50.848:46941) : argc=3 a0=grep a1=-E a2=.*password.*$|.*credential.*$|creds.*$|.*\.key$ 
type=EXECVE msg=audit(02/20/2025 10:00:50.736:46925) : argc=3 a0=grep a1=-E a2=master\.key$|hudson\.util\.Secret$|credentials\.xml$|config\.xml$|.*jenkins$ 
type=EXECVE msg=audit(02/20/2025 10:00:50.244:46840) : argc=3 a0=grep a1=-E a2=.*\.pgp$|.*\.gpg$|.*\.gnupg$ 
type=EXECVE msg=audit(02/20/2025 10:00:50.146:46822) : argc=3 a0=grep a1=-E a2=keyrings$|.*\.keyring$|.*\.keystore$|.*\.jks$ 
type=EXECVE msg=audit(02/20/2025 10:00:49.927:46786) : argc=3 a0=grep a1=-E a2=krb5\.conf$|.*\.keytab$|\.k5login$|krb5cc_.*$|kadm5\.acl$|secrets\.ldb$|\.secrets\.mkey$|sssd\.conf$ 
type=EXECVE msg=audit(02/20/2025 10:00:49.805:46771) : argc=3 a0=grep a1=-E a2=.*\.pfx$|.*\.p12$ 
type=EXECVE msg=audit(02/20/2025 10:00:49.742:46765) : argc=3 a0=grep a1=-E a2=.*\.pem$|.*\.cer$|.*\.crt$ 
type=EXECVE msg=audit(02/20/2025 10:00:49.572:46743) : argc=3 a0=grep a1=-E a2=glusterfs\.pem$|glusterfs\.ca$|glusterfs\.key$