A Linux user’s bash history was searched for patterns like ‘pass’ and ‘ssh’, and the matching lines were redirected into a new file. Determine the name of that file.

DeviceFileEvents | where FileName != '' and (FileName contains 'pass' or FileName contains 'ssh') | summarize count() by FileName

DeviceProcessEvents
| where (InitiatingProcessCommandLine contains 'bash' and InitiatingProcessCommandLine contains 'history' and (InitiatingProcessCommandLine contains 'pass' or InitiatingProcessCommandLine contains 'ssh')) and InitiatingProcessCommandLine contains '>'
| extend TargetFile = tostring(split(InitiatingProcessCommandLine, '>')[1])
| project DeviceName, AccountName, InitiatingProcessCommandLine, TargetFile

DeviceProcessEvents
| where ProcessCommandLine has_all ("bash_history", "pass", "ssh", ">")
| extend CmdRegex = extract(@">\s*(\S+)", 1, ProcessCommandLine) // Extract the file redirected to
| where isnotempty(CmdRegex)
| project TimeGenerated, DeviceName, ProcessCommandLine, RedirectedFile=CmdRegex
| summarize count() by RedirectedFile
| top 10 by count_

DeviceProcessEvents
| where ProcessCommandLine has_cs "pass" and ProcessCommandLine has_cs "ssh"
| extend OutputFile = extract(@"(?:>|>>)\s*(\S+)", 1, ProcessCommandLine)
| where isnotempty(OutputFile)
| distinct OutputFile

DeviceProcessEvents
| where ProcessCommandLine has "cat ~/.bash_history" and ProcessCommandLine matches regex @"pass|ssh" and ProcessCommandLine has ">"
| extend RedirectedFile = extract(@">\s*(\S+)", 1, ProcessCommandLine)
| project DeviceId, DeviceName, RedirectedFile

let TimeRange = 1d;
DeviceProcessEvents
| where TimeGenerated >= ago(TimeRange)
| where InitiatingProcessCommandLine contains "grep"
| where (InitiatingProcessCommandLine contains "pass" or InitiatingProcessCommandLine contains "ssh")
| where InitiatingProcessCommandLine contains ".bash_history"
| where InitiatingProcessCommandLine contains ">"
| extend Parts = split(InitiatingProcessCommandLine, ">")
| extend DestinationFile = trim(" ", tostring(Parts[array_length(Parts) - 1]))
| where isnotempty(DestinationFile)
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessCommandLine, DestinationFile
| sort by TimeGenerated desc

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName contains 'bash' or ProcessCommandLine contains 'history'
| where ProcessCommandLine has_any ('pass', 'ssh')
| where ProcessCommandLine matches regex @'\s*>\s*[^\s|;]+'
| extend OutputFile = extract(@'\s*>\s*([^\s|;]+)', 1, ProcessCommandLine)
| join kind=inner (
    DeviceInfo
    | where OSDistribution contains 'Linux' or OSPlatform contains 'Linux'
) on DeviceId
| project DeviceName, AccountName, ProcessCommandLine, OutputFile, TimeGenerated
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine contains 'grep' and ProcessCommandLine contains 'pass' and ProcessCommandLine contains 'ssh' and ProcessCommandLine contains '.bash_history' and ProcessCommandLine contains '>'
| extend FileName = extract(@' > (\S+)', 1, ProcessCommandLine)
| project FileName, ProcessCommandLine, TimeGenerated
| summarize arg_max(TimeGenerated, *) by FileName

DeviceProcessEvents
| join kind=inner (
    DeviceInfo
    | where OSPlatform == "Linux"
) on DeviceId
| where ProcessCommandLine has ".bash_history"
| where ProcessCommandLine has_any ("pass", "ssh")
| where ProcessCommandLine contains ">"
| extend outputFile = extract(@">{1,2}\s+([^\s]+)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, ProcessCommandLine, outputFile
| order by TimeGenerated desc

DeviceProcessEvents
| where DeviceId in (
    DeviceInfo
    | where OSPlatform =~ "Linux"
    | project DeviceId
)
| where FileName =~ "grep" or ProcessCommandLine contains "grep"
| where ProcessCommandLine has_any ("pass", "ssh")
| where ProcessCommandLine contains ">"
| extend RedirectFile = extract(@"[>]{1,2}\s+([^\s]+)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, RedirectFile, ProcessCommandLine
| summarize count() by RedirectFile

DeviceProcessEvents
| where InitiatingProcessCommandLine has "bash_history"
      and InitiatingProcessCommandLine has "pass"
      and InitiatingProcessCommandLine has "ssh"
      and InitiatingProcessCommandLine has ">"
| extend redir_file = extract(@">\s*(\S+)", 1, InitiatingProcessCommandLine)
| project TimeGenerated, redir_file, InitiatingProcessCommandLine
| distinct redir_file

DeviceProcessEvents
| where ProcessCommandLine contains "bash_history" and ProcessCommandLine contains "grep"
| where ProcessCommandLine has_any ("pass", "ssh")
| where ProcessCommandLine contains ">"
| extend outputFile = trim(' ', extract(@">\s*([^\s;]+)", 1, ProcessCommandLine))
| distinct outputFile

DeviceProcessEvents
// Filter for processes invoking grep (handles cases where FileName or the full command line contains 'grep')
| where tolower(FileName) endswith "grep" or tolower(ProcessCommandLine) contains "grep"
// Match whole-word occurrences of 'pass' or 'ssh'
| where ProcessCommandLine matches regex @"\b(pass|ssh)\b"
// Ensure redirection of output
| where ProcessCommandLine contains ">"
// Extract the filename after '>' or '>>'
| extend OutFile = trim('"''', extract(@"(?:>>|>)\s*([^\s]+)", 1, ProcessCommandLine))
// Select and sort results
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, grepCommand = ProcessCommandLine, OutFile
| sort by TimeGenerated desc