Question Analysis

let latestLinuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | summarize arg_max(TimeGenerated, *) by DeviceId; let interestingFiles = dynamic([ "/etc/default/locale", "/etc/locale.conf", "/etc/locale.gen", "/etc/sysconfig/i18n", "/etc/profile.d/lang.sh", "/etc/rc.conf.d/i18n.conf", "/etc/environment" ]); let interestingNames = dynamic(["locale.conf","locale","locale.gen","i18n","i18n.conf","environment","lang.sh"]); // 1) File read/open telemetry to locale files let file_reads = union isfuzzy=true ( DeviceFileEvents | where FileName in~ (interestingNames) | extend FullPath = strcat(FolderPath, iff(FolderPath endswith "/", "", "/"), FileName) | where FullPath in (interestingFiles) | where ActionType in~ ("FileRead", "ReadFile", "FileAccessed", "FileOpened", "FileOpen", "OpenFile") | project TimeGenerated, DeviceId, DeviceName, FullPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessAccountName ), ( // Fallback: some tenants expose file access via DeviceEvents DeviceEvents | where FileName in~ (interestingNames) | extend FullPath = strcat(FolderPath, iff(FolderPath endswith "/", "", "/"), FileName) | where FullPath in (interestingFiles) | where ActionType in~ ("FileRead", "ReadFile", "FileAccessed", "FileOpened", "FileOpen", "OpenFile") | project TimeGenerated, DeviceId, DeviceName, FullPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessAccountName ); // 2) Process CLI fallback: commands that reference locale files (if file-read telemetry is sparse) let process_refs = DeviceProcessEvents | where ProcessCommandLine has_any (interestingFiles) or FileName in~ ("cat","grep","less","more","head","tail","awk","sed","strings","python","perl","bash","sh","zsh","curl","localectl","locale") | extend FullPath = extract(@"(/etc/(?:default/locale|locale\.conf|locale\.gen|sysconfig/i18n|profile\.d/lang\.sh|rc\.conf\.d/i18n\.conf|environment))", 1, ProcessCommandLine) | where isnotempty(FullPath) | project TimeGenerated, DeviceId, DeviceName, FullPath, ActionType = "ProcessRef", InitiatingProcessFileName = FileName, InitiatingProcessCommandLine = ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessAccountName; union file_reads, process_refs | join kind=inner latestLinuxDevices on DeviceId | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Reads=count(), LocaleFiles=make_set(FullPath), SampleCommand=any(InitiatingProcessCommandLine) by DeviceName, Tool=InitiatingProcessFileName, InitiatingProcessParentFileName, InitiatingProcessAccountName | order by LastSeen desc, Reads desc

union DeviceFileEvents, DeviceProcessEvents | where ActionType in ("FileAccessed", "FileOpened", "FileRead", "ProcessCreated", "ProcessLaunched") | where (FolderPath has "etc" or ProcessCommandLine has "/etc") and (FileName contains "locale" or ProcessCommandLine has "locale") | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId, DeviceName ) on DeviceId | project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine | order by TimeGenerated desc

union isfuzzy=true DeviceFileEvents, DeviceProcessEvents | where FolderPath has "/etc" or FileName has "locale.conf" or ProcessCommandLine has "/etc/locale.conf" or InitiatingProcessCommandLine has "/etc/locale.conf" | order by TimeGenerated desc | project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

// ----- PARAMETERS ----------------------------------------------------------- let TimeRange = 7d; // Replace or drive externally let LocaleFiles = dynamic(["/etc/locale.conf", "/etc/default/locale"]); // ----- 1. Low-level file I/O that touches the locale files ------------------- let FileReadHits = DeviceFileEvents | where Timestamp >= ago(TimeRange) | where ActionType in ("FileRead", "FileOpen", "FileAccessRead", "FileAccessed") // Build canonical full path and check if it matches one of our targets | extend FullPath = tostring(replace(@"/{2,}", "/", strcat(FolderPath, '/', FileName))) | where FullPath in (LocaleFiles) | project TimeGenerated, DeviceId, DeviceName, Tool = tostring(InitiatingProcessFileName), ToolCommandLine = tostring(InitiatingProcessCommandLine), ToolSHA256 = tostring(InitiatingProcessSHA256), UserAccount = tostring(InitiatingProcessAccountName); // ----- 2. Processes whose command line references the locale files ---------- let CmdlineHits = DeviceProcessEvents | where Timestamp >= ago(TimeRange) | where ProcessCommandLine has_any (LocaleFiles) | project TimeGenerated, DeviceId, DeviceName, Tool = tostring(FileName), ToolCommandLine = tostring(ProcessCommandLine), ToolSHA256 = tostring(SHA256), UserAccount = tostring(AccountName); // ----- 3. Combine, summarise and present ------------------------------------ (FileReadHits | union CmdlineHits) | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), EventCount= count() by DeviceId, DeviceName, Tool, ToolCommandLine, ToolSHA256, UserAccount | order by LastSeen desc

union DeviceFileEvents, DeviceProcessEvents | where (FolderPath contains "/etc" and (FileName has "locale" or FileName has "locale.conf")) or (ProcessCommandLine has "/etc/locale") | extend Tool = iif(isnotempty(InitiatingProcessFileName), InitiatingProcessFileName, FileName), CommandLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | distinct Tool, CommandLine | project Tool, CommandLine