Question Analysis

DeviceFileEvents | where FileName == ".bash_profile" | where FolderPath startswith "/home/" or FolderPath endswith "/.bash_profile" | where ActionType in ("FileCreated", "FileModified", "FileWrite", "FileWritten") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FolderPath, FileName, AdditionalFields | extend AppendedContent = tostring(AdditionalFields.content_added) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FolderPath, AppendedContent

let target = "bash_profile"; union DeviceFileEvents, DeviceEvents, DeviceProcessEvents | where FileName has target or FolderPath has target or InitiatingProcessCommandLine has target or ProcessCommandLine has target or tostring(AdditionalFields) has target | extend Context = tostring(coalesce(InitiatingProcessCommandLine, ProcessCommandLine, AdditionalFields)) // try to extract common append patterns: echo/printf with >>, sed -i append, here-doc (cat <<EOF >> file) | extend echo_match = extract(@"(?i)([^;\n]{0,300}>>\s*(?:~/)?\.?bash_profile)", 1, Context) | extend sed_match = extract(@"(?i)(sed\s+-i[^\r\n]*\$?a\\[^\n\r]*\s+(?:~/)?\.?bash_profile)", 1, Context) | extend heredoc_match = extract(@"(?i)(<<[^>\n\r]{0,200}>>\s*(?:~/)?\.?bash_profile)", 1, Context) | extend appended_command = trim(" ", coalesce(echo_match, sed_match, heredoc_match)) | where isnotempty(appended_command) | project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, ProcessCommandLine, appended_command, AdditionalFields | order by TimeGenerated desc | take 50

// Search for .bash_profile modifications and extract appended command strings union isfuzzy=true DeviceFileEvents, DeviceEvents | where TimeGenerated >= ago(7d) // Filter likely file write/modify actions | where ActionType has_any ("FileCreated","FileModified","FileWrite","FileChange","FileWriteEnd","FileAttributeChanged","FileOverwritten","Modified","Write","Append","Update","FileSaved") // Narrow to bash_profile filename or path | where FileName has "bash_profile" or FolderPath has "bash_profile" or FileName endswith "bash_profile" or FolderPath endswith "bash_profile" // Safely parse AdditionalFields if present | extend AdditionalFields_dyn = iif(isnull(AdditionalFields) or tostring(AdditionalFields) == "", dynamic({}), todynamic(AdditionalFields)) // Try to extract appended command from common keys | extend appended_command = coalesce( tostring(AdditionalFields_dyn.append), tostring(AdditionalFields_dyn.appended), tostring(AdditionalFields_dyn.appended_text), tostring(AdditionalFields_dyn.apendedCommand), tostring(AdditionalFields_dyn.new_line), tostring(AdditionalFields_dyn.NewLine), tostring(AdditionalFields_dyn.command), tostring(AdditionalFields_dyn.Command), tostring(AdditionalFields_dyn.Content), tostring(AdditionalFields_dyn.lines), tostring(AdditionalFields_dyn.line), tostring(RegistryValueData), tostring(PreviousFileName), tostring(PreviousFolderPath) ) // Also consider command lines from processes and other fields | extend possible_cmds = pack_array( appended_command, tostring(InitiatingProcessCommandLine), tostring(ProcessCommandLine), tostring(AdditionalFields_dyn.command_line), tostring(AdditionalFields_dyn.cmd), tostring(AdditionalFields_dyn.cmdline), tostring(RegistryValueData), tostring(PreviousFileName) ) // Unpack possible command candidates | mv-expand possible_cmd = possible_cmds to typeof(string) | where isnotempty(possible_cmd) // Clean whitespace | extend possible_cmd = trim(" \t\n\r", possible_cmd) // Group identical appended strings and show sample events (limit samples to 10 per group) | summarize Count = count(), Samples = take_any(pack('TimeGenerated', TimeGenerated,'DeviceName', DeviceName,'ActionType', ActionType,'FileName', FileName,'FolderPath', FolderPath,'InitiatingProcessFileName', InitiatingProcessFileName,'InitiatingProcessCommandLine', InitiatingProcessCommandLine,'ProcessCommandLine', ProcessCommandLine,'Extracted', possible_cmd), 10) by possible_cmd | where Count > 0 | order by Count desc | project AppendedCommand = possible_cmd, Count, Samples | take 100

DeviceFileEvents | where FolderPath endswith '/.bash_profile' and ActionType in~ ('FileCreate', 'FileCreated', 'FileModify', 'FileModified') | join kind=inner (DeviceInfo | where OSPlatform == 'Linux') on DeviceId | project Timestamp, DeviceName, FolderPath, InitiatingProcessCommandLine | order by Timestamp desc | take 10

DeviceProcessEvents | join kind=inner ( DeviceInfo | where tolower(OSPlatform) == "linux" ) on DeviceId | where tolower(ProcessCommandLine) has ".bash_profile" // Filter for known shell appends like >>. You can broaden or adjust as needed. // If you specifically suspect 'echo "content" >> ~/.bash_profile', you might do: // where tolower(ProcessCommandLine) has " >> " | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc

// 1. Identify all Linux devices let LinuxDeviceIds = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; // 2. Find .bash_profile file events on Linux devices DeviceFileEvents | where DeviceId in (LinuxDeviceIds) | where FileName == ".bash_profile" | where ActionType in ("FileCreated", "FileModified", "FileOverwritten") // 3. Filter for append operations | where InitiatingProcessCommandLine has ">>" or InitiatingProcessCommandLine has "tee -a" // 4. Project relevant details | project TimeGenerated, DeviceName, FilePath = strcat(FolderPath, "/", FileName), AppendingProcess = InitiatingProcessFileName, AppendingCommandLine = InitiatingProcessCommandLine // 5. Sort by time | sort by TimeGenerated desc

DeviceFileEvents | where FileName == ".bash_profile" | where ActionType in ("FileModified", "FileCreated") | extend FullPath = strcat(FolderPath, "/", FileName) | where FullPath endswith "/.bash_profile" | project TimeGenerated, DeviceName, InitiatingUser = strcat(InitiatingProcessAccountName, "@", InitiatingProcessAccountDomain), InitiatingProcessFile = InitiatingProcessFileName, InitiatingProcessId, CommandLine = InitiatingProcessCommandLine | sort by TimeGenerated desc