{"ip":"45.148.10.212","data_as_of":"2026-10-26T23:47:42+00:00","observed":true,"total_events":28,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"72 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["72 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 28 event(s) from this address as well.","Not in any known-scanner range.","Sent 122,308 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"122,308 bytes sent","bytes_sent":122308,"session_seconds":20,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-21T04:32:35","last_seen":"2026-10-25T13:06:51","events_24h":0,"events_7d":28,"interactive_sessions":132,"interactive_sessions_24h":0,"interactive_sessions_7d":132,"interactive_protocols":[{"protocol":"ssh","sessions":130},{"protocol":"sunrpc","sessions":2}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"32b5c936c45dc602f09cd54f648926ea3a58ece3f8135d9fa083e3ea3762258e","family":"","vt_name":"o","malicious":2,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":777,"hits":4,"last_seen":"2026-10-21 11:21:52"}],"udp":null,"interaction":{"window_days":90,"sessions":132,"first_seen":"2026-10-21T04:32:35","last_seen":"2026-10-25T13:06:51","verdicts":[{"verdict":"post-exploitation","sessions":72},{"verdict":"credential","sessions":47},{"verdict":"unknown","sessions":11},{"verdict":"scan","sessions":2}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":110},{"persona":"linux-ubuntu@20.04","sessions":20},{"persona":"nfs@nfs-kernel-server 1.3.4","sessions":1},{"persona":"nfs@nfs-kernel-server 2.6.1","sessions":1}],"services":[{"protocol":"ssh","port":53572,"sessions":56},{"protocol":"ssh","port":64331,"sessions":24},{"protocol":"ssh","port":18,"sessions":24},{"protocol":"ssh","port":9587,"sessions":13},{"protocol":"ssh","port":777,"sessions":7},{"protocol":"ssh","port":2,"sessions":6},{"protocol":"sunrpc","port":111,"sessions":2}],"logins":[{"username":"root","password":"lovely","password_sent":true,"service":"ssh-password","outcome":"success","tries":6,"last_seen":"2026-10-24T13:46:13"},{"username":"root","password":"qwe1231a","password_sent":true,"service":"ssh-password","outcome":"success","tries":6,"last_seen":"2026-10-24T06:46:55"},{"username":"root","password":"Passwd123$%^","password_sent":true,"service":"ssh-password","outcome":"success","tries":6,"last_seen":"2026-10-24T00:10:50"},{"username":"root","password":"0p9o8i7u6y5t4r","password_sent":true,"service":"ssh-password","outcome":"failure","tries":5,"last_seen":"2026-10-24T00:10:52"},{"username":"guest","password":"321","password_sent":true,"service":"ssh-password","outcome":"success","tries":3,"last_seen":"2026-10-24T00:11:08"},{"username":"root","password":"asd123456","password_sent":true,"service":"ssh-password","outcome":"failure","tries":3,"last_seen":"2026-10-24T00:11:02"},{"username":"root","password":"daniel123","password_sent":true,"service":"ssh-password","outcome":"failure","tries":3,"last_seen":"2026-10-24T00:10:59"},{"username":"guset","password":"123qwe","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-25T13:06:46"},{"username":"root","password":"password#1234","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-25T13:06:45"},{"username":"jennyng","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:38"},{"username":"jamil","password":"jamil","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:35"},{"username":"apache","password":"q1w2e3","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:32"},{"username":"elastic","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:30"},{"username":"csserver","password":"root","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:26"},{"username":"rabbitmq","password":"rabbit@root","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:24"},{"username":"guest","password":"pass123","password_sent":true,"service":"ssh-password","outcome":"failure","tries":2,"last_seen":"2026-10-24T00:11:24"},{"username":"root","password":"kiyoko123","password_sent":true,"service":"ssh-password","outcome":"failure","tries":2,"last_seen":"2026-10-24T00:11:22"},{"username":"claudinei","password":"claudinei","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:21"},{"username":"server","password":"1234567","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-24T00:11:13"},{"username":"admin","password":"09N1RCa1Hs31","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-22T18:10:00"},{"username":"root","password":"qwer4321!@#$","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-21T11:22:21"},{"username":"huangsiyan","password":"huangsiyan","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-21T11:21:48"},{"username":"root","password":"Welcome2","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-24T13:46:20"},{"username":"root","password":"clumsy07705346941","password_sent":true,"service":"ssh-password","outcome":"failure","tries":1,"last_seen":"2026-10-24T06:46:57"},{"username":"root","password":"0p9o8i7u6y5t4r","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-24T00:10:57"}],"commands":[{"ts":"2026-10-25T13:06:51","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"hostname","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uptime","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -a","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/os-release 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:50","session_id":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo OK","exit_code":0},{"ts":"2026-10-25T13:06:49","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-25T13:06:49","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-25T13:06:49","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uptime","exit_code":0},{"ts":"2026-10-25T13:06:49","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-25T13:06:49","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-25T13:06:49","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nproc","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nproc","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -a","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uptime","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -a","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"hostname","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/os-release 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -a","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"2e04ae7a-9cdd-4a87-ac8e-03a0aa3cedf2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo OK","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"hostname","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"hostname","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:48","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /etc/os-release 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:47","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-25T13:06:47","session_id":"d8ce48d4-56f5-4ead-8036-494717fc4897","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo OK","exit_code":0},{"ts":"2026-10-25T13:06:47","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-25T13:06:47","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uptime","exit_code":0},{"ts":"2026-10-25T13:06:46","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /etc/os-release 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T13:06:46","session_id":"9647c662-41f7-46ed-9b8e-37f833528c19","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo OK","exit_code":0},{"ts":"2026-10-24T13:46:29","session_id":"dc526362-c0ef-46e4-9628-5d61caa47740","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-24T13:46:29","session_id":"dc526362-c0ef-46e4-9628-5d61caa47740","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0}],"downloads":[{"url":"[http]://rup[.]ksoftir[.]cc/php/o","host":"rup[.]ksoftir[.]cc","sessions":2,"first_seen":"2026-10-21T11:21:52","last_seen":"2026-10-21T11:22:25","virustotal":{"sha256":"32b5c936c45dc602f09cd54f648926ea3a58ece3f8135d9fa083e3ea3762258e","status":"uploaded","malicious":2,"total":75,"name":"o"}}],"files":[{"sha256":"94b2d169be95b0aa4f7681a15cd0ae31b13d1262d82a816ef124a6cc4af2c887","name":".ametist","size":8,"mime_type":"text/plain","kind":"shell-write","times":49,"first_seen":"2026-10-21T11:21:39","last_seen":"2026-10-24T00:11:46","virustotal":null},{"sha256":"f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2","name":"test_1792800706","size":5,"mime_type":"text/plain","kind":"shell-write","times":46,"first_seen":"2026-10-21T11:21:40","last_seen":"2026-10-24T00:11:47","virustotal":null},{"sha256":"c4b2102d1a175645db47d9beb787a1cbeab0f4df5b8944f51d8894f4e75a4dff","name":"authorized_keys","size":100,"mime_type":"text/plain","kind":"shell-write","times":32,"first_seen":"2026-10-21T11:21:46","last_seen":"2026-10-24T00:11:52","virustotal":null},{"sha256":"f5c9076f6ca3cc6f38febe0de684249c5bce6820b73b60dc8097719d54a89a9a","name":"o","size":27,"mime_type":"text/plain","kind":"downloaded","times":2,"first_seen":"2026-10-21T11:21:52","last_seen":"2026-10-21T11:22:25","virustotal":null},{"sha256":"f7fdd941d39c2362dc32adf18f706b59f4c728bee188233160aa25a02ebfbe4f","name":"o","size":15931,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-21T11:21:52","last_seen":"2026-10-21T11:22:25","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":2},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":72},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":72},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":119},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":2}]},"top_ports":[{"port":53572,"proto":"tcp","label":"","count":4,"sessions":56},{"port":64331,"proto":"tcp","label":"","count":4,"sessions":24},{"port":18,"proto":"tcp","label":"","count":4,"sessions":24},{"port":9587,"proto":"tcp","label":"","count":4,"sessions":13},{"port":777,"proto":"tcp","label":"","count":4,"sessions":7},{"port":2,"proto":"tcp","label":"","count":4,"sessions":6},{"port":111,"proto":"tcp","label":"RPC","count":4,"sessions":2}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"16443846184eafde36765c9bab2f4397":45},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-21","count":8,"sessions":9},{"date":"2026-10-22","count":4,"sessions":56},{"date":"2026-10-23","count":9,"sessions":3},{"date":"2026-10-24","count":3,"sessions":58},{"date":"2026-10-25","count":4,"sessions":6}],"recent_events":[{"timestamp":"2026-10-25T13:06:51","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","payload_hex":"6e76696469612d736d69202d2d71756572792d6770753d6e616d65202d2d666f726d61743d6373762c6e6f68656164657220323e2f6465762f6e756c6c207c2068656164202d31","method":"","user_agent":"","ja3":"","session":"d8ce48d4-56f5-4ead-8036-494717fc4897-23","seq":23,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"47aa6bea3978cf9e","strings":["nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","payload_hex":"6e657473746174202d74756c706e20323e2f6465762f6e756c6c207c2067726570204c495354454e207c2068656164202d3230","method":"","user_agent":"","ja3":"","session":"d8ce48d4-56f5-4ead-8036-494717fc4897-21","seq":21,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66c5676d8f38874c","strings":["netstat -tulpn 2>/dev/null | grep LISTEN | head -20"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"netstat -tulpn 2>/dev/null | head -10","payload_hex":"6e657473746174202d74756c706e20323e2f6465762f6e756c6c207c2068656164202d3130","method":"","user_agent":"","ja3":"","session":"d8ce48d4-56f5-4ead-8036-494717fc4897-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"94439b651f765ba2","strings":["netstat -tulpn 2>/dev/null | head -10"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","payload_hex":"6e76696469612d736d69202d2d71756572792d6770753d6e616d65202d2d666f726d61743d6373762c6e6f68656164657220323e2f6465762f6e756c6c207c2068656164202d31","method":"","user_agent":"","ja3":"","session":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb-23","seq":23,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"47aa6bea3978cf9e","strings":["nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ps aux 2>/dev/null | head -10","payload_hex":"70732061757820323e2f6465762f6e756c6c207c2068656164202d3130","method":"","user_agent":"","ja3":"","session":"d8ce48d4-56f5-4ead-8036-494717fc4897-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d188b8795e9a8b8f","strings":["ps aux 2>/dev/null | head -10"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","payload_hex":"6e657473746174202d74756c706e20323e2f6465762f6e756c6c207c2067726570204c495354454e207c2068656164202d3230","method":"","user_agent":"","ja3":"","session":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb-21","seq":21,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66c5676d8f38874c","strings":["netstat -tulpn 2>/dev/null | grep LISTEN | head -20"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"hostname","payload_hex":"686f73746e616d65","method":"","user_agent":"","ja3":"","session":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"709381e970d2d669","strings":["hostname"]},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"netstat -tulpn 2>/dev/null | head -10","payload_hex":"6e657473746174202d74756c706e20323e2f6465762f6e756c6c207c2068656164202d3130","method":"","user_agent":"","ja3":"","session":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"94439b651f765ba2","strings":["netstat -tulpn 2>/dev/null | head -10"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ps aux 2>/dev/null | head -10","payload_hex":"70732061757820323e2f6465762f6e756c6c207c2068656164202d3130","method":"","user_agent":"","ja3":"","session":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d188b8795e9a8b8f","strings":["ps aux 2>/dev/null | head -10"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T13:06:50","port":2,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls -la / 2>/dev/null | head -20","payload_hex":"6c73202d6c61202f20323e2f6465762f6e756c6c207c2068656164202d3230","method":"","user_agent":"","ja3":"","session":"85d360e7-63a4-410f-aedc-2f3d4bdd38fb-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ebfa0eb99775d527","strings":["ls -la / 2>/dev/null | head -20"],"iocs":{"paths":["/dev/null"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":7,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":28}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":72},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":72},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":2},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":119}]}