Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "find" | where ProcessCommandLine contains ".aws" | where ProcessCommandLine contains "-name" or ProcessCommandLine contains "-iname" | extend searchedFilename = extract(@'-i?name\s+(".*?"|\S+)', 1, ProcessCommandLine) | project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, searchedFilename

DeviceProcessEvents | where ProcessCommandLine contains "find" and ProcessCommandLine contains ".aws" | where ProcessCommandLine contains "credentials" or ProcessCommandLine contains "credential" | project TimeGenerated, DeviceName, ProcessId, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessParentId

DeviceProcessEvents | where InitiatingProcessCommandLine contains 'find' and InitiatingProcessCommandLine has '.aws' | where InitiatingProcessCommandLine matches regex @'(?i)(credentials|config|keys)' | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FolderPath

let linux_devices = DeviceInfo | where OSPlatform == "Linux" | project DeviceId; DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner (linux_devices) on DeviceId | where tolower(FileName) == "find" or ProcessCommandLine has " find " | where ProcessCommandLine has ".aws" and ProcessCommandLine has_any ("-name", "-iname") // Extract the searched pattern after -name / -iname (handles "...", '...', or unquoted) | extend SearchedName_dq = extract(@'-i?name\s+"([^"]+)"', 1, ProcessCommandLine), SearchedName_sq = extract(@'-i?name\s+''([^'']+)''', 1, ProcessCommandLine), SearchedName_nq = extract(@'-i?name\s+([^\s]+)', 1, ProcessCommandLine) | extend SearchedName = coalesce(SearchedName_dq, SearchedName_sq, SearchedName_nq) | where isnotempty(SearchedName) // Normalize: lowercase, trim quotes/spaces, remove wildcard characters | extend CredentialFilename = replace_string(tolower(trim(" *'\"", SearchedName)), "*", "") | summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SampleCommand = any(ProcessCommandLine) by CredentialFilename | order by Count desc

DeviceProcessEvents | where ProcessCommandLine has "find" and ProcessCommandLine has ".aws" // try to capture the argument after -name or -iname | extend name_arg = extract("(?i)(?:-name|-iname)\\s+([^ ]+)", 1, ProcessCommandLine) // try to capture .aws/<file> with forward or back slashes | extend dotaws_path = extract("(?i)\\.aws/([^ ]+)", 1, ProcessCommandLine) | extend dotaws_path_bs = extract("(?i)\\.aws\\\\([^ ]+)", 1, ProcessCommandLine) // capture common credential/config filenames mentioned directly | extend direct_common = extract("(?i)\\b(credentials(?:\\.json)?|config|access_key|secret_access_key|id_rsa|credentials\\.yml|credentials\\.yaml)\\b", 1, ProcessCommandLine) // pick the first non-empty candidate and lowercase it | extend candidate = tolower(coalesce(name_arg, dotaws_path, dotaws_path_bs, direct_common, "")) | where candidate != "" | summarize Count = count(), Examples = make_set(ProcessCommandLine, 5) by Candidate = candidate | sort by Count desc

union DeviceProcessEvents, DeviceEvents, DeviceFileEvents | extend CommandLine = tolower(coalesce(ProcessCommandLine, InitiatingProcessCommandLine, "")) | where CommandLine contains "find" and CommandLine contains ".aws" | extend cmd = replace_string(CommandLine, "\\", "/") // take a reasonable window starting at the .aws occurrence | extend after = substring(cmd, indexof(cmd, ".aws"), 300) // get the path segment immediately after .aws/ if present | extend aws_next = tostring(split(after, "/")[1]) // try to parse explicit find arguments (-name, -iname, -path, -wholename) | extend nameToken1 = iff(indexof(cmd, "-name ") >= 0, tostring(split(substring(cmd, indexof(cmd, "-name ") + 6, 200), " ")[0]), "") | extend nameToken2 = iff(indexof(cmd, "-iname ") >= 0, tostring(split(substring(cmd, indexof(cmd, "-iname ") + 7, 200), " ")[0]), "") | extend nameToken3 = iff(indexof(cmd, "-path ") >= 0, tostring(split(substring(cmd, indexof(cmd, "-path ") + 6, 200), " ")[0]), "") | extend nameToken4 = iff(indexof(cmd, "-wholename ") >= 0, tostring(split(substring(cmd, indexof(cmd, "-wholename ") + 11, 200), " ")[0]), "") | extend nameRaw = case(nameToken1 != "", nameToken1, nameToken2 != "", nameToken2, nameToken3 != "", nameToken3, nameToken4 != "", nameToken4, "") | extend RawTarget = iff(nameRaw != "", nameRaw, aws_next) // strip surrounding quotes and wildcard characters | extend TargetFilename = replace_regex(replace_regex(RawTarget, "^[\\\"'\\*]+", ""), "[\\\"'\\*]+$", "") | where isnotempty(TargetFilename) | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), ExampleCommand = any(CommandLine) by DeviceId, DeviceName, AccountName, TargetFilename | project FirstSeen, LastSeen, Count, DeviceName, DeviceId, AccountName, TargetFilename, ExampleCommand | order by LastSeen desc

DeviceInfo | where OSPlatform == "Linux" | join kind=inner ( DeviceProcessEvents | where ProcessCommandLine contains "find" and ProcessCommandLine contains ".aws" | extend filename = extract(@"-name\s+([^\s]+)", 1, ProcessCommandLine) | project DeviceId, ProcessCommandLine, filename ) on DeviceId | project DeviceName, ProcessCommandLine, filename | summarize UniqueFilenames = make_set(filename) by DeviceName | project DeviceName, UniqueFilenames

let LinuxDevices = DeviceInfo | where OSPlatform startswith "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ActionType == "ProcessCreated" | where ProcessCommandLine has "find" and ProcessCommandLine has ".aws" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, AWSFilename = extract("-name\\s+['\"]([^'\"]+)", 1, ProcessCommandLine) | where isnotempty(AWSFilename)

DeviceProcessEvents | where InitiatingProcessCommandLine has "find" and InitiatingProcessCommandLine has ".aws" | extend credential_filename = extract("-name\\s+['\\\"]?([^'\\\"\\s]+)", 1, InitiatingProcessCommandLine) | where isnotempty(credential_filename) | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, credential_filename | sort by TimeGenerated desc