Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "find" and (ProcessCommandLine has "-perm" and (ProcessCommandLine has "2000" or ProcessCommandLine has "/2000" or ProcessCommandLine has "-2000") or ProcessCommandLine has "g+s") | project Timestamp, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents | where FileName contains 'bash' or FileName contains 'sh' | where ProcessCommandLine has 'find' and (ProcessCommandLine has_any ('-perm', 'g+s')) | project DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where FileName =~ "find" | where ProcessCommandLine has "-perm" | where ProcessCommandLine has_any ("g=s", "/2000", "2000", "2600") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, ProcessId, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains "-perm" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc | limit 20

DeviceProcessEvents | where isnotempty(ProcessCommandLine) | where ProcessCommandLine matches regex @".*\b(find|grep|chmod|ls)\b.*\b(group|sudo|permission)\b.*" | project TimeGenerated, DeviceName, ProcessCommandLine, AccountName

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where ActionType == "ProcessCreated" | where DeviceId in (linuxDevices) // Optional: scope to a specific device or user if known // | where DeviceName == "<hostname>" or AccountName =~ "<user>" | where ProcessCommandLine has "find" // Look for SGID or other elevated group permission searches | where ProcessCommandLine matches regex @"(?i)\bfind\b.*(-perm\s+(-|/)?g\s*[=+]\s*s|-perm\s+-0?2000|-perm\s+(-|/)?g\s*[=+]\s*w)" | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, ProcessId, InitiatingProcessId, DeviceId | order by TimeGenerated asc

union isfuzzy=true DeviceProcessEvents, DeviceEvents | where TimeGenerated between (startofday(ago(7d)) .. now()) | extend cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine, ProcessCommandLine)) | where isnotempty(cmd) // focus on Linux-origin or commonly Linux shells (optional separate filter if your environment sets SourceSystem) | where SourceSystem == "Linux" or tolower(DeviceName) contains "linux" or cmd has "bash" or cmd has "sh" or cmd has "zsh" or cmd has "ksh" or cmd has "find" // look for find invocations that include permission checks or SUID/SGID bits | where cmd has "find" and (cmd has "-perm" or cmd has "suid" or cmd has "sgid" or cmd has "setgid" or cmd has "setuid" or cmd has "-2000" or cmd has "-4000" or cmd has "g+s" or cmd has "g+w") | extend find_cmd = extract(@"(?i)(find\s+[^;\n]+)", 1, cmd) | extend perm_part = extract(@"(?i)(-perm\s+[^\s;]+|g\+s|g\+w|suid|sgid|-2000|-4000|-perm[:=]?[^\s;]+)", 1, cmd) | project TimeGenerated, DeviceName, DeviceId, ProcessId, InitiatingProcessId, AccountName, InitiatingProcessAccountName, ProcessCreationTime, cmd, find_cmd, perm_part | order by TimeGenerated desc | distinct DeviceName, ProcessId, cmd, TimeGenerated | limit 200

DeviceProcessEvents | where isnotempty(ProcessCommandLine) | where (InitiatingProcessFileName in ('bash','sh','zsh','dash','ash') or InitiatingProcessCommandLine contains '/bin/bash' or InitiatingProcessCommandLine contains '/bin/sh') | where ProcessCommandLine contains 'find' and ((ProcessCommandLine contains '-perm') or (ProcessCommandLine contains 'setgid') or (ProcessCommandLine contains 'g=s')) | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, ProcessCommandLine, ProcessId, AccountName, InitiatingProcessAccountName, InitiatingProcessAccountDomain | sort by TimeGenerated desc | take 50

let StartTime = ago(24h); DeviceProcessEvents | where TimeGenerated between (StartTime .. now()) | extend CmdLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | where CmdLine contains "bash" or CmdLine contains "/bin/bash" or CmdLine contains "sh" or CmdLine contains "/bin/sh" | where CmdLine contains "find" and (CmdLine contains "-perm" or CmdLine contains "perm") and ((CmdLine contains "2000") or (CmdLine contains "setgid") or (CmdLine contains "setuid") or (CmdLine contains "g+s")) | project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, CmdLine, ProcessId, ProcessCommandLine, InitiatingProcessCreationTime | sort by TimeGenerated asc

DeviceProcessEvents | join kind=inner DeviceInfo on DeviceId | where OSPlatform contains "Linux" | where ProcessCommandLine has "find" and ProcessCommandLine has_any ("group", "-group", "perm", "-perm") | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc | limit 50

DeviceProcessEvents | join kind=inner ( DeviceInfo | where OSPlatform =~ "Linux" ) on DeviceId | where ActionType == "ProcessCreated" | where ProcessCommandLine has "find" and ProcessCommandLine has_any ("perm", "sgid") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath, InitiatingProcessFolderPath | order by TimeGenerated desc

let LinuxDevices = DeviceInfo | where OSPlatform startswith "Linux" | project DeviceId, OSPlatform, DeviceName; DeviceProcessEvents | where Timestamp between (startofday(ago(1d)) .. now()) // Time range placeholder – replaced by portal picker | join kind=inner (LinuxDevices) on DeviceId | where FileName in ("find","sh","bash","dash","ksh","zsh","csh") or ProcessCommandLine has "find" | where ProcessCommandLine has "-perm" and ( ProcessCommandLine has "-g=s" or ProcessCommandLine has "-g+s" or ProcessCommandLine has "-2000" or ProcessCommandLine has "-02000" or ProcessCommandLine has "-2\000" // numeric SGID variations ) | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, ProcessId, InitiatingProcessId | order by TimeGenerated desc

DeviceProcessEvents | where isnotempty(InitiatingProcessCommandLine) | where InitiatingProcessCommandLine has "find" and InitiatingProcessCommandLine has "-perm" | project TimeGenerated, DeviceName, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "find" and ProcessCommandLine has "-2000" | project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath, FileName | sort by TimeGenerated desc

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where ProcessCommandLine matches regex @"\bfind\b.*(-perm\s+(?:/g\+s|-2000))" | project TimeGenerated, DeviceName, ProcessId, InitiatingProcessFileName, InitiatingProcessAccountName, ProcessCommandLine | sort by TimeGenerated asc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "find" and ProcessCommandLine has "-perm" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessId, ProcessCommandLine | sort by TimeGenerated desc