Event #24567
Recorded 3 weeks ago
Command
Critical
default-host
140.82.46.49
66.135.25.80
root
Dec 2, 2025 00:14:06
Command
docker exec azuracast mariadb -u azuracast -pREffKmptM662 azuracast -e "
-- Get listener data for Microsparks (station 21) from Nov 17 to Dec 1
-- This should match the Asura report timeframe
SELECT
listener_ip as IP,
timestamp_start as Start_Time,
timestamp_end as End_Time,
TIMESTAMPDIFF(SECOND, timestamp_start, COALESCE(timestamp_end, NOW())) as Seconds_Connected,
listener_user_agent as User_Agent,
CASE WHEN mount_id IS NOT NULL THEN 'Local' ELSE 'Remote' END as Mount_Type,
device_client,
device_is_bot,
location_description
FROM listener
WHERE station_id = 21
AND timestamp_start >= '2025-11-17'
AND timestamp_start <= '2025-12-02'
ORDER BY timestamp_start;
" 2> /dev/null
Raw Event Data
{
"pid": 3196927,
"tty": "unknown",
"ppid": 3196887,
"user": "root",
"shell": "\/bin\/bash",
"command": "docker exec azuracast mariadb -u azuracast -pREffKmptM662 azuracast -e \"\n-- Get listener data for Microsparks (station 21) from Nov 17 to Dec 1\n-- This should match the Asura report timeframe\nSELECT \n listener_ip as IP,\n timestamp_start as Start_Time,\n timestamp_end as End_Time,\n TIMESTAMPDIFF(SECOND, timestamp_start, COALESCE(timestamp_end, NOW())) as Seconds_Connected,\n listener_user_agent as User_Agent,\n CASE WHEN mount_id IS NOT NULL THEN 'Local' ELSE 'Remote' END as Mount_Type,\n device_client,\n device_is_bot,\n location_description\nFROM listener\nWHERE station_id = 21\nAND timestamp_start >= '2025-11-17'\nAND timestamp_start <= '2025-12-02'\nORDER BY timestamp_start;\n\" 2> \/dev\/null",
"user_ip": "66.135.25.80",
"exit_code": 0,
"server_ip": "140.82.46.49",
"timestamp": "2025-12-02T00:14:06.228Z",
"event_type": "command",
"received_at": "2025-12-02T00:14:06.627526",
"server_name": "Azura3",
"honeypot_name": "Azura3",
"parent_command": "sshd",
"ssh_connection": "66.135.25.80 35896 140.82.46.49 22",
"server_location": "NJ",
"honeypot_location": "NJ",
"working_directory": "\/root"
}Risk Assessment
High Risk
Critical severity event detected
Actions
Related Events
Related events feature coming soon