Question Analysis

DeviceFileEvents | where FileName != '' and (FileName contains 'pass' or FileName contains 'ssh') | summarize count() by FileName

DeviceProcessEvents | where (InitiatingProcessCommandLine contains 'bash' and InitiatingProcessCommandLine contains 'history' and (InitiatingProcessCommandLine contains 'pass' or InitiatingProcessCommandLine contains 'ssh')) and InitiatingProcessCommandLine contains '>' | extend TargetFile = tostring(split(InitiatingProcessCommandLine, '>')[1]) | project DeviceName, AccountName, InitiatingProcessCommandLine, TargetFile

DeviceProcessEvents | where ProcessCommandLine has_all ("bash_history", "pass", "ssh", ">") | extend CmdRegex = extract(@">\s*(\S+)", 1, ProcessCommandLine) // Extract the file redirected to | where isnotempty(CmdRegex) | project TimeGenerated, DeviceName, ProcessCommandLine, RedirectedFile=CmdRegex | summarize count() by RedirectedFile | top 10 by count_

DeviceProcessEvents | where ProcessCommandLine has_cs "pass" and ProcessCommandLine has_cs "ssh" | extend OutputFile = extract(@"(?:>|>>)\s*(\S+)", 1, ProcessCommandLine) | where isnotempty(OutputFile) | distinct OutputFile

DeviceProcessEvents | where ProcessCommandLine has "cat ~/.bash_history" and ProcessCommandLine matches regex @"pass|ssh" and ProcessCommandLine has ">" | extend RedirectedFile = extract(@">\s*(\S+)", 1, ProcessCommandLine) | project DeviceId, DeviceName, RedirectedFile

DeviceProcessEvents | where TimeGenerated > ago(30d) | where InitiatingProcessFileName contains 'bash' or ProcessCommandLine contains 'history' | where ProcessCommandLine has_any ('pass', 'ssh') | where ProcessCommandLine matches regex @'\s*>\s*[^\s|;]+' | extend OutputFile = extract(@'\s*>\s*([^\s|;]+)', 1, ProcessCommandLine) | join kind=inner ( DeviceInfo | where OSDistribution contains 'Linux' or OSPlatform contains 'Linux' ) on DeviceId | project DeviceName, AccountName, ProcessCommandLine, OutputFile, TimeGenerated | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains 'grep' and ProcessCommandLine contains 'pass' and ProcessCommandLine contains 'ssh' and ProcessCommandLine contains '.bash_history' and ProcessCommandLine contains '>' | extend FileName = extract(@' > (\S+)', 1, ProcessCommandLine) | project FileName, ProcessCommandLine, TimeGenerated | summarize arg_max(TimeGenerated, *) by FileName

DeviceProcessEvents | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" ) on DeviceId | where ProcessCommandLine has ".bash_history" | where ProcessCommandLine has_any ("pass", "ssh") | where ProcessCommandLine contains ">" | extend outputFile = extract(@">{1,2}\s+([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, outputFile | order by TimeGenerated desc

DeviceProcessEvents | where DeviceId in ( DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId ) | where FileName =~ "grep" or ProcessCommandLine contains "grep" | where ProcessCommandLine has_any ("pass", "ssh") | where ProcessCommandLine contains ">" | extend RedirectFile = extract(@"[>]{1,2}\s+([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, RedirectFile, ProcessCommandLine | summarize count() by RedirectFile

DeviceProcessEvents | where InitiatingProcessCommandLine has "bash_history" and InitiatingProcessCommandLine has "pass" and InitiatingProcessCommandLine has "ssh" and InitiatingProcessCommandLine has ">" | extend redir_file = extract(@">\s*(\S+)", 1, InitiatingProcessCommandLine) | project TimeGenerated, redir_file, InitiatingProcessCommandLine | distinct redir_file

DeviceProcessEvents | where ProcessCommandLine contains "bash_history" and ProcessCommandLine contains "grep" | where ProcessCommandLine has_any ("pass", "ssh") | where ProcessCommandLine contains ">" | extend outputFile = trim(' ', extract(@">\s*([^\s;]+)", 1, ProcessCommandLine)) | distinct outputFile

DeviceProcessEvents // Filter for processes invoking grep (handles cases where FileName or the full command line contains 'grep') | where tolower(FileName) endswith "grep" or tolower(ProcessCommandLine) contains "grep" // Match whole-word occurrences of 'pass' or 'ssh' | where ProcessCommandLine matches regex @"\b(pass|ssh)\b" // Ensure redirection of output | where ProcessCommandLine contains ">" // Extract the filename after '>' or '>>' | extend OutFile = trim('"''', extract(@"(?:>>|>)\s*([^\s]+)", 1, ProcessCommandLine)) // Select and sort results | project TimeGenerated, DeviceName, InitiatingProcessAccountName, grepCommand = ProcessCommandLine, OutFile | sort by TimeGenerated desc