A Linux system shows a shell invocation that appears to be searching for files with elevated group permissions. Using the available process execution logs, determine exactly what command was run.

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine has "find" and (ProcessCommandLine has "-perm" and (ProcessCommandLine has "2000" or ProcessCommandLine has "/2000" or ProcessCommandLine has "-2000") or ProcessCommandLine has "g+s")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents
| where FileName contains 'bash' or FileName contains 'sh'
| where ProcessCommandLine has 'find' and (ProcessCommandLine has_any ('-perm', 'g+s'))
| project DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, TimeGenerated

DeviceProcessEvents
| where FileName =~ "find"
| where ProcessCommandLine has "-perm"
| where ProcessCommandLine has_any ("g=s", "/2000", "2000", "2600")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, ProcessId, InitiatingProcessAccountName
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine contains "-perm"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
| order by TimeGenerated desc
| limit 20

DeviceProcessEvents
| where isnotempty(ProcessCommandLine)
| where ProcessCommandLine matches regex @".*\b(find|grep|chmod|ls)\b.*\b(group|sudo|permission)\b.*"
| project TimeGenerated, DeviceName, ProcessCommandLine, AccountName

let linuxDevices = DeviceInfo
    | where OSPlatform == "Linux"
    | distinct DeviceId;
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where DeviceId in (linuxDevices)
// Optional: scope to a specific device or user if known
// | where DeviceName == "<hostname>" or AccountName =~ "<user>"
| where ProcessCommandLine has "find"
// Look for SGID or other elevated group permission searches
| where ProcessCommandLine matches regex @"(?i)\bfind\b.*(-perm\s+(-|/)?g\s*[=+]\s*s|-perm\s+-0?2000|-perm\s+(-|/)?g\s*[=+]\s*w)"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, 
          InitiatingProcessFileName, InitiatingProcessCommandLine, 
          InitiatingProcessParentFileName, ProcessId, InitiatingProcessId, DeviceId
| order by TimeGenerated asc

union isfuzzy=true DeviceProcessEvents, DeviceEvents
| where TimeGenerated between (startofday(ago(7d)) .. now())
| extend cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine, ProcessCommandLine))
| where isnotempty(cmd)
// focus on Linux-origin or commonly Linux shells (optional separate filter if your environment sets SourceSystem)
| where SourceSystem == "Linux" or tolower(DeviceName) contains "linux" or cmd has "bash" or cmd has "sh" or cmd has "zsh" or cmd has "ksh" or cmd has "find"
// look for find invocations that include permission checks or SUID/SGID bits
| where cmd has "find" and (cmd has "-perm" or cmd has "suid" or cmd has "sgid" or cmd has "setgid" or cmd has "setuid" or cmd has "-2000" or cmd has "-4000" or cmd has "g+s" or cmd has "g+w")
| extend find_cmd = extract(@"(?i)(find\s+[^;\n]+)", 1, cmd)
| extend perm_part = extract(@"(?i)(-perm\s+[^\s;]+|g\+s|g\+w|suid|sgid|-2000|-4000|-perm[:=]?[^\s;]+)", 1, cmd)
| project TimeGenerated, DeviceName, DeviceId, ProcessId, InitiatingProcessId, AccountName, InitiatingProcessAccountName, ProcessCreationTime, cmd, find_cmd, perm_part
| order by TimeGenerated desc
| distinct DeviceName, ProcessId, cmd, TimeGenerated
| limit 200

DeviceProcessEvents
| where isnotempty(ProcessCommandLine)
| where (InitiatingProcessFileName in ('bash','sh','zsh','dash','ash')
       or InitiatingProcessCommandLine contains '/bin/bash'
       or InitiatingProcessCommandLine contains '/bin/sh')
| where ProcessCommandLine contains 'find' and ((ProcessCommandLine contains '-perm') or (ProcessCommandLine contains 'setgid') or (ProcessCommandLine contains 'g=s'))
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, ProcessCommandLine, ProcessId, AccountName, InitiatingProcessAccountName, InitiatingProcessAccountDomain
| sort by TimeGenerated desc
| take 50

let StartTime = ago(24h); DeviceProcessEvents
| where TimeGenerated between (StartTime .. now())
| extend CmdLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine)
| where CmdLine contains "bash" or CmdLine contains "/bin/bash" or CmdLine contains "sh" or CmdLine contains "/bin/sh"
| where CmdLine contains "find" and (CmdLine contains "-perm" or CmdLine contains "perm") and ((CmdLine contains "2000") or (CmdLine contains "setgid") or (CmdLine contains "setuid") or (CmdLine contains "g+s"))
| project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, CmdLine, ProcessId, ProcessCommandLine, InitiatingProcessCreationTime
| sort by TimeGenerated asc

DeviceProcessEvents
| join kind=inner DeviceInfo on DeviceId
| where OSPlatform contains "Linux"
| where ProcessCommandLine has "find" and ProcessCommandLine has_any ("group", "-group", "perm", "-perm")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
| limit 50

DeviceProcessEvents
| join kind=inner (
    DeviceInfo
    | where OSPlatform =~ "Linux"
) on DeviceId
| where ActionType == "ProcessCreated"
| where ProcessCommandLine has "find" and ProcessCommandLine has_any ("perm", "sgid")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath, InitiatingProcessFolderPath
| order by TimeGenerated desc

let LinuxDevices = DeviceInfo
    | where OSPlatform startswith "Linux"
    | project DeviceId, OSPlatform, DeviceName;
DeviceProcessEvents
| where Timestamp between (startofday(ago(1d)) .. now()) // Time range placeholder – replaced by portal picker
| join kind=inner (LinuxDevices) on DeviceId
| where FileName in ("find","sh","bash","dash","ksh","zsh","csh") or ProcessCommandLine has "find"
| where ProcessCommandLine has "-perm" and (
        ProcessCommandLine has "-g=s" or
        ProcessCommandLine has "-g+s" or 
        ProcessCommandLine has "-2000" or
        ProcessCommandLine has "-02000" or
        ProcessCommandLine has "-2\000" // numeric SGID variations
    )
| project TimeGenerated,
          DeviceName,
          AccountName,
          FileName,
          ProcessCommandLine,
          FolderPath,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessAccountName,
          ProcessId,
          InitiatingProcessId
| order by TimeGenerated desc

DeviceProcessEvents
| where isnotempty(InitiatingProcessCommandLine)
| where InitiatingProcessCommandLine has "find" and InitiatingProcessCommandLine has "-perm"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine has "find" and ProcessCommandLine has "-2000"
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath, FileName
| sort by TimeGenerated desc

let linuxDevices = DeviceInfo
| where OSPlatform == "Linux"
| distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (linuxDevices)
| where ProcessCommandLine matches regex @"\bfind\b.*(-perm\s+(?:/g\+s|-2000))"
| project TimeGenerated, DeviceName, ProcessId, InitiatingProcessFileName, InitiatingProcessAccountName, ProcessCommandLine
| sort by TimeGenerated asc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine has "find" and ProcessCommandLine has "-perm"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessId, ProcessCommandLine
| sort by TimeGenerated desc