{"ip":"222.126.105.187","data_as_of":"2026-10-24T15:04:10+00:00","observed":true,"total_events":1524,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"90 interactive session(s) ran commands after logging in","confidence":"high","network_type":"residential ISP","why":["90 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1,524 event(s) from this address as well.","Not in any known-scanner range.","Sent 1,786,004 bytes, which is sustained payload delivery.","Held a session open for 76s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"1,786,004 bytes sent, longest session 76s","bytes_sent":1786004,"session_seconds":76,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-16T14:05:31","last_seen":"2026-10-24T07:59:45","events_24h":0,"events_7d":564,"interactive_sessions":90,"interactive_sessions_24h":51,"interactive_sessions_7d":90,"interactive_protocols":[{"protocol":"ssh","sessions":90}],"geo":{"country_code":"PH","country_name":"Philippines","region":"","city":"","lat":14.5955,"lon":120.9721,"asn":7629,"org":"5F L.V. Locsin Bldg"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as7629","label":"VITRO 7629","category":"isp","url":"https://www.peeringdb.com/asn/7629"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":90,"first_seen":"2026-10-22T04:31:13","last_seen":"2026-10-24T07:59:45","verdicts":[{"verdict":"post-exploitation","sessions":90}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":45},{"persona":"linux-ubuntu@20.04","sessions":45}],"services":[{"protocol":"ssh","port":22,"sessions":90}],"logins":[{"username":"root","password":"!qaz2wsx","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T07:59:03"},{"username":"root","password":"!q2w3e4r","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T07:39:19"},{"username":"root","password":"!QAZxsw23edc","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T07:19:46"},{"username":"root","password":"!QAZxsw2#EDC","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T07:00:34"},{"username":"root","password":"!QAZ@WSX3edc","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T06:40:50"},{"username":"root","password":"!QAZ3edc","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T06:21:13"},{"username":"root","password":"!QAZ2wsx3edc","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T06:02:37"},{"username":"root","password":"!QAZ2wsx#EDC","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T05:44:55"},{"username":"root","password":"!QAZ2wsx","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T05:28:03"},{"username":"root","password":"!@#123qwe","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T05:11:16"},{"username":"root","password":"!@#$%^","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-24T04:54:23"},{"username":"root","password":"123.com","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T20:26:30"},{"username":"root","password":"123","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T19:43:51"},{"username":"root","password":"12131415","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T19:20:03"},{"username":"root","password":"11223344Asdf","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T18:55:34"},{"username":"root","password":"11223344","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T18:32:24"},{"username":"root","password":"112233","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T18:08:47"},{"username":"root","password":"11111111","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T17:46:30"},{"username":"root","password":"111111","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T17:23:00"},{"username":"root","password":"11111","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T17:00:56"},{"username":"root","password":"1111","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T16:38:51"},{"username":"root","password":"111","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T16:16:54"},{"username":"root","password":"100200","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T15:55:54"},{"username":"root","password":"1","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T15:35:13"},{"username":"root","password":"00000000","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T15:15:16"}],"commands":[{"ts":"2026-10-24T07:59:44","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ss -tuln 2>/dev/null | wc -l","exit_code":0},{"ts":"2026-10-24T07:59:43","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"rm -f /tmp/test","exit_code":0},{"ts":"2026-10-24T07:59:42","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"time dd if=/dev/zero of=/tmp/test bs=1M count=10 2>&1","exit_code":0},{"ts":"2026-10-24T07:59:40","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ping -c 1 8[.]8[.]8[.]8 2>/dev/null | grep '1 packets transmitted'","exit_code":0},{"ts":"2026-10-24T07:59:39","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"systemctl list-units --type=service --state=running 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-24T07:59:38","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"which zypper","exit_code":1},{"ts":"2026-10-24T07:59:37","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"which pacman","exit_code":1},{"ts":"2026-10-24T07:59:36","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"which yum","exit_code":1},{"ts":"2026-10-24T07:59:34","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"which apt","exit_code":0},{"ts":"2026-10-24T07:59:33","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r","exit_code":0},{"ts":"2026-10-24T07:59:32","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1","exit_code":0},{"ts":"2026-10-24T07:59:31","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"pwd","exit_code":0},{"ts":"2026-10-24T07:59:30","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"whoami","exit_code":0},{"ts":"2026-10-24T07:59:29","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"id","exit_code":0},{"ts":"2026-10-24T07:59:27","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /proc/version 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-24T07:59:26","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/shadow 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-24T07:59:25","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/passwd 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-24T07:59:24","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"rm -f /tmp/test_1792828764","exit_code":0},{"ts":"2026-10-24T07:59:23","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'test' > /tmp/test_1792828764","exit_code":0},{"ts":"2026-10-24T07:59:22","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ip route show 2>/dev/null | head -3","exit_code":0},{"ts":"2026-10-24T07:59:21","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ip addr show 2>/dev/null | grep -E '^[0-9]+:' | head -5","exit_code":0},{"ts":"2026-10-24T07:59:20","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -la /etc/network/interfaces /etc/sysconfig/network-scripts/ /etc/netplan/ 2>/dev/null | head -5","exit_code":0},{"ts":"2026-10-24T07:59:19","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-24T07:59:18","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"history | tail -5","exit_code":0},{"ts":"2026-10-24T07:59:17","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | grep -i vga || lspci | grep -i nvidia || echo 'No GPU info'","exit_code":0},{"ts":"2026-10-24T07:59:16","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uptime","exit_code":0},{"ts":"2026-10-24T07:59:15","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn | head -10","exit_code":0},{"ts":"2026-10-24T07:59:14","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ps aux | head -10","exit_code":0},{"ts":"2026-10-24T07:59:14","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"whoami","exit_code":0},{"ts":"2026-10-24T07:59:13","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"free -h | head -2","exit_code":0},{"ts":"2026-10-24T07:59:12","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc || grep -c processor /proc/cpuinfo","exit_code":0},{"ts":"2026-10-24T07:59:12","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1","exit_code":0},{"ts":"2026-10-24T07:59:11","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"env | head -10","exit_code":0},{"ts":"2026-10-24T07:59:10","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"pwd","exit_code":0},{"ts":"2026-10-24T07:59:09","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"hostname","exit_code":0},{"ts":"2026-10-24T07:59:09","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"df -h | head -5","exit_code":0},{"ts":"2026-10-24T07:59:08","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"mount | head -5","exit_code":0},{"ts":"2026-10-24T07:59:07","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ssh -V 2>&1","exit_code":127},{"ts":"2026-10-24T07:59:07","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -la /","exit_code":0},{"ts":"2026-10-24T07:59:06","session_id":"cbaae66f-1d3f-40e0-acab-493451aa9a55","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -a","exit_code":0},{"ts":"2026-10-24T07:55:58","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ss -tuln 2>/dev/null | wc -l","exit_code":0},{"ts":"2026-10-24T07:55:57","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"rm -f /tmp/test","exit_code":0},{"ts":"2026-10-24T07:55:56","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"time dd if=/dev/zero of=/tmp/test bs=1M count=10 2>&1","exit_code":0},{"ts":"2026-10-24T07:55:55","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ping -c 1 8[.]8[.]8[.]8 2>/dev/null | grep '1 packets transmitted'","exit_code":0},{"ts":"2026-10-24T07:55:54","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"systemctl list-units --type=service --state=running 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-24T07:55:53","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"which zypper","exit_code":1},{"ts":"2026-10-24T07:55:52","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"which pacman","exit_code":1},{"ts":"2026-10-24T07:55:51","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"which yum","exit_code":1},{"ts":"2026-10-24T07:55:50","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"which apt","exit_code":0},{"ts":"2026-10-24T07:55:49","session_id":"47fc6595-3799-4f0e-8ad5-8434d0ef6fc8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -r","exit_code":0}],"downloads":[],"files":[{"sha256":"f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2","name":"test_1792685516","size":5,"mime_type":"text/plain","kind":"shell-write","times":90,"first_seen":"2026-10-22T04:31:07","last_seen":"2026-10-24T07:59:23","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":90},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":90},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":90}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":81,"sessions":90},{"port":58027,"proto":"tcp","label":"","count":74,"sessions":0},{"port":30330,"proto":"tcp","label":"","count":67,"sessions":0},{"port":5725,"proto":"tcp","label":"","count":67,"sessions":0},{"port":46662,"proto":"tcp","label":"","count":66,"sessions":0},{"port":28852,"proto":"tcp","label":"","count":66,"sessions":0},{"port":35545,"proto":"tcp","label":"","count":66,"sessions":0},{"port":50237,"proto":"tcp","label":"","count":64,"sessions":0},{"port":43848,"proto":"tcp","label":"","count":64,"sessions":0},{"port":9899,"proto":"tcp","label":"","count":63,"sessions":0},{"port":52103,"proto":"tcp","label":"","count":63,"sessions":0},{"port":30888,"proto":"tcp","label":"","count":63,"sessions":0},{"port":22948,"proto":"tcp","label":"","count":63,"sessions":0},{"port":19570,"proto":"tcp","label":"","count":63,"sessions":0},{"port":54155,"proto":"tcp","label":"","count":62,"sessions":0}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"16443846184eafde36765c9bab2f4397":44},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-16","count":492,"sessions":0},{"date":"2026-10-17","count":987,"sessions":0},{"date":"2026-10-21","count":45,"sessions":0},{"date":"2026-10-22","count":0,"sessions":11},{"date":"2026-10-23","count":0,"sessions":57},{"date":"2026-10-24","count":0,"sessions":22}],"recent_events":[{"timestamp":"2026-10-24T07:59:44","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ss -tuln 2>/dev/null | wc -l","payload_hex":"7373202d74756c6e20323e2f6465762f6e756c6c207c207763202d6c","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-79","seq":79,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"53f9720c8c49d17a","strings":["ss -tuln 2>/dev/null | wc -l"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-24T07:59:43","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"rm -f /tmp/test","payload_hex":"726d202d66202f746d702f74657374","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-77","seq":77,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f274bdcb73f1234f","strings":["rm -f /tmp/test"],"iocs":{"paths":["/tmp/test"]}},"interactive":true},{"timestamp":"2026-10-24T07:59:42","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"time dd if=/dev/zero of=/tmp/test bs=1M count=10 2>&1","payload_hex":"74696d652064642069663d2f6465762f7a65726f206f663d2f746d702f746573742062733d314d20636f756e743d313020323e2631","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-75","seq":75,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"59a627be5af2745d","strings":["time dd if=/dev/zero of=/tmp/test bs=1M count=10 2>&1"],"iocs":{"paths":["/dev/zero","/tmp/test"]}},"interactive":true},{"timestamp":"2026-10-24T07:59:40","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ping -c 1 8.8.8.8 2>/dev/null | grep '1 packets transmitted'","payload_hex":"70696e67202d63203120382e382e382e3820323e2f6465762f6e756c6c207c2067726570202731207061636b657473207472616e736d697474656427","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-73","seq":73,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ba4c5001e203824e","strings":["ping -c 1 8.8.8.8 2>/dev/null | grep '1 packets transmitted'"],"iocs":{"ips":["8.8.8.8"],"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-24T07:59:39","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"systemctl list-units --type=service --state=running 2>/dev/null | head -10","payload_hex":"73797374656d63746c206c6973742d756e697473202d2d747970653d73657276696365202d2d73746174653d72756e6e696e6720323e2f6465762f6e756c6c207c2068656164202d3130","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-71","seq":71,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cc1d11c6e1619dbe","strings":["systemctl list-units --type=service --state=running 2>/dev/null | head -10"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-24T07:59:38","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"which zypper","payload_hex":"7768696368207a7970706572","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-69","seq":69,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b2f1f54804b4ea38","strings":["which zypper"]},"interactive":true},{"timestamp":"2026-10-24T07:59:37","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"which pacman","payload_hex":"7768696368207061636d616e","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-67","seq":67,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"75d0d844fa52e0e5","strings":["which pacman"]},"interactive":true},{"timestamp":"2026-10-24T07:59:36","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"which yum","payload_hex":"77686963682079756d","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-65","seq":65,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0e59aa13429a9963","strings":["which yum"]},"interactive":true},{"timestamp":"2026-10-24T07:59:34","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"which apt","payload_hex":"776869636820617074","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-63","seq":63,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"63bcab650d432c61","strings":["which apt"]},"interactive":true},{"timestamp":"2026-10-24T07:59:33","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -r","payload_hex":"756e616d65202d72","method":"","user_agent":"","ja3":"","session":"cbaae66f-1d3f-40e0-acab-493451aa9a55-61","seq":61,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dac7878220e23198","strings":["uname -r"]},"interactive":true}],"http_methods":[],"distinct_ports_total":24,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1491}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":90},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":90},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":90}]}