A Linux host was probed by reading its locale configuration file to discover the system language. Identify which tool was invoked to perform that read operation.

let latestLinuxDevices = DeviceInfo
| where OSPlatform =~ "Linux"
| summarize arg_max(TimeGenerated, *) by DeviceId;
let interestingFiles = dynamic([
  "/etc/default/locale",
  "/etc/locale.conf",
  "/etc/locale.gen",
  "/etc/sysconfig/i18n",
  "/etc/profile.d/lang.sh",
  "/etc/rc.conf.d/i18n.conf",
  "/etc/environment"
]);
let interestingNames = dynamic(["locale.conf","locale","locale.gen","i18n","i18n.conf","environment","lang.sh"]);
// 1) File read/open telemetry to locale files
let file_reads =
union isfuzzy=true
(
  DeviceFileEvents
  | where FileName in~ (interestingNames)
  | extend FullPath = strcat(FolderPath, iff(FolderPath endswith "/", "", "/"), FileName)
  | where FullPath in (interestingFiles)
  | where ActionType in~ ("FileRead", "ReadFile", "FileAccessed", "FileOpened", "FileOpen", "OpenFile")
  | project TimeGenerated, DeviceId, DeviceName, FullPath, ActionType,
            InitiatingProcessFileName, InitiatingProcessCommandLine,
            InitiatingProcessParentFileName, InitiatingProcessAccountName
),
(
  // Fallback: some tenants expose file access via DeviceEvents
  DeviceEvents
  | where FileName in~ (interestingNames)
  | extend FullPath = strcat(FolderPath, iff(FolderPath endswith "/", "", "/"), FileName)
  | where FullPath in (interestingFiles)
  | where ActionType in~ ("FileRead", "ReadFile", "FileAccessed", "FileOpened", "FileOpen", "OpenFile")
  | project TimeGenerated, DeviceId, DeviceName, FullPath, ActionType,
            InitiatingProcessFileName, InitiatingProcessCommandLine,
            InitiatingProcessParentFileName, InitiatingProcessAccountName
);
// 2) Process CLI fallback: commands that reference locale files (if file-read telemetry is sparse)
let process_refs =
DeviceProcessEvents
| where ProcessCommandLine has_any (interestingFiles)
   or FileName in~ ("cat","grep","less","more","head","tail","awk","sed","strings","python","perl","bash","sh","zsh","curl","localectl","locale")
| extend FullPath = extract(@"(/etc/(?:default/locale|locale\.conf|locale\.gen|sysconfig/i18n|profile\.d/lang\.sh|rc\.conf\.d/i18n\.conf|environment))", 1, ProcessCommandLine)
| where isnotempty(FullPath)
| project TimeGenerated, DeviceId, DeviceName, FullPath,
          ActionType = "ProcessRef",
          InitiatingProcessFileName = FileName,
          InitiatingProcessCommandLine = ProcessCommandLine,
          InitiatingProcessParentFileName,
          InitiatingProcessAccountName;
union file_reads, process_refs
| join kind=inner latestLinuxDevices on DeviceId
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Reads=count(),
            LocaleFiles=make_set(FullPath), SampleCommand=any(InitiatingProcessCommandLine)
  by DeviceName, Tool=InitiatingProcessFileName, InitiatingProcessParentFileName, InitiatingProcessAccountName
| order by LastSeen desc, Reads desc

union DeviceFileEvents, DeviceProcessEvents
| where ActionType in ("FileAccessed", "FileOpened", "FileRead", "ProcessCreated", "ProcessLaunched")
| where (FolderPath has "etc" or ProcessCommandLine has "/etc")
    and (FileName contains "locale" or ProcessCommandLine has "locale")
| join kind=inner (
    DeviceInfo
    | where OSPlatform == "Linux"
    | distinct DeviceId, DeviceName
) on DeviceId
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          ProcessCommandLine
| order by TimeGenerated desc

union isfuzzy=true DeviceFileEvents, DeviceProcessEvents
| where FolderPath has "/etc" or FileName has "locale.conf" or ProcessCommandLine has "/etc/locale.conf" or InitiatingProcessCommandLine has "/etc/locale.conf"
| order by TimeGenerated desc
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

// ----- PARAMETERS -----------------------------------------------------------
let TimeRange = 7d;                                // Replace or drive externally
let LocaleFiles = dynamic(["/etc/locale.conf", "/etc/default/locale"]);

// ----- 1. Low-level file I/O that touches the locale files -------------------
let FileReadHits = DeviceFileEvents
| where Timestamp >= ago(TimeRange)
| where ActionType in ("FileRead", "FileOpen", "FileAccessRead", "FileAccessed")
// Build canonical full path and check if it matches one of our targets
| extend FullPath = tostring(replace(@"/{2,}", "/", strcat(FolderPath, '/', FileName)))
| where FullPath in (LocaleFiles)
| project TimeGenerated,
          DeviceId,
          DeviceName,
          Tool            = tostring(InitiatingProcessFileName),
          ToolCommandLine = tostring(InitiatingProcessCommandLine),
          ToolSHA256      = tostring(InitiatingProcessSHA256),
          UserAccount     = tostring(InitiatingProcessAccountName);

// ----- 2. Processes whose command line references the locale files ----------
let CmdlineHits = DeviceProcessEvents
| where Timestamp >= ago(TimeRange)
| where ProcessCommandLine has_any (LocaleFiles)
| project TimeGenerated,
          DeviceId,
          DeviceName,
          Tool            = tostring(FileName),
          ToolCommandLine = tostring(ProcessCommandLine),
          ToolSHA256      = tostring(SHA256),
          UserAccount     = tostring(AccountName);

// ----- 3. Combine, summarise and present ------------------------------------
(FileReadHits
 | union CmdlineHits)
| summarize   FirstSeen = min(TimeGenerated),
             LastSeen  = max(TimeGenerated),
             EventCount= count()
         by DeviceId, DeviceName, Tool, ToolCommandLine, ToolSHA256, UserAccount
| order by LastSeen desc

union DeviceFileEvents, DeviceProcessEvents
| where (FolderPath contains "/etc" and (FileName has "locale" or FileName has "locale.conf"))
      or (ProcessCommandLine has "/etc/locale")
| extend Tool = iif(isnotempty(InitiatingProcessFileName), InitiatingProcessFileName, FileName),
         CommandLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine)
| distinct Tool, CommandLine
| project Tool, CommandLine