A user‐space process on a Linux device invoked a shell to capture and display the system’s environment variables and path. Which exact command was used to perform this discovery?

let command_discovery = dynamic(["env", "printenv"]);
let binaries = dynamic(["sh", "csh", "zsh", "dash", "bash", "rbash"]);
DeviceProcessEvents
| where ActionType has_any ("CreateProcess", "ForkEvent", "ProcessCreated")
| where FileName has_any (binaries)
| where ProcessCommandLine has_any (command_discovery)
| extend CommandLine = tostring(ProcessCommandLine)
| summarize argCount = count(), processNames = make_set(ProcessCommandLine,1000) by FileName, CommandLine
| sort by argCount desc
// Uncomment below for exact execution time and parent process info:
// | summarize argCount = count(), processNames = make_set(ProcessCommandLine,1000) by FileName, FolderPath, Timestamp, InitiatingProcessParentFileName
// | mv-expand processNames
// | extend CommandLine = tostring(processNames)
// | project-away processNames

DeviceProcessEvents
| where DeviceName contains "linux" or InitiatingProcessFileName in ("bash", "sh", "zsh")
| where ProcessCommandLine has_any ("env", "printenv", "set")
| project DeviceName, ProcessCommandLine, ProcessCreationTime
| order by ProcessCreationTime desc

DeviceProcessEvents
| where FolderPath contains '/bin' or FolderPath contains '/usr/bin' or FolderPath contains 'bin/'
| where ProcessCommandLine contains 'printenv' or ProcessCommandLine contains 'env' or ProcessCommandLine contains 'set'
| where ProcessCommandLine contains '| grep' or ProcessCommandLine contains 'grep'
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessId

DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("env", "printenv", "echo $PATH")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, AccountName, AccountDomain, ProcessCommandLine

let shells = pack_array("sh","bash","dash","zsh","ksh","busybox","fish");
let linuxDevices =
    DeviceInfo
    | where OSPlatform =~ "Linux"
    | summarize arg_max(TimeGenerated, *) by DeviceId
    | project DeviceId;
let env_rx = @"(?i)\b(env|printenv|export\s+-p|set)\b";
let path_rx = @"(?i)(\$PATH|\bPATH=|\bprintenv\s+PATH\b|\becho\s+\$PATH\b|\bgrep\s+-i\s+\^?PATH\b)";
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where DeviceId in (linuxDevices)
| where FileName in~ (shells) or ProcessCommandLine has_any ("sh -c","bash -c","dash -c","zsh -c","ksh -c","busybox sh -c","/bin/sh -c","/usr/bin/sh -c","/bin/bash -c","/usr/bin/bash -c")
| extend ShellCmd = coalesce(
    extract(@"(?i)(?:^|\s)-{0,2}c\s+(['""])(.*?)\1", 2, ProcessCommandLine),
    extract(@"(?i)(?:^|\s)-{0,2}c\s+(.+)$", 1, ProcessCommandLine)
)
| extend ExactCommand = trim(" ", coalesce(ShellCmd, ProcessCommandLine))
| where InitiatingProcessFileName !in~ (shells)
| where InitiatingProcessFileName !in~ (pack_array("systemd","init","kworker","kswapd","kthreadd"))
| where ExactCommand matches regex env_rx and ExactCommand matches regex path_rx
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ExactCommand
| order by TimeGenerated desc

let shellRegex = @"(?i)^(bash|sh|zsh|dash|ksh|ash|/bin/(bash|sh)|/usr/bin/(bash|sh))$";
let envRegex = @"(?i)(\benv\b|\bprintenv\b|echo\s+\$PATH|cat\s+/proc/(\w+|self)/environ|/proc/self/environ|\bset\b|printenv\s+-)";
DeviceProcessEvents
| where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine)
// Ensure the process or its initiator is a shell
| where FileName matches regex shellRegex or InitiatingProcessFileName matches regex shellRegex or ProcessCommandLine matches regex shellRegex or InitiatingProcessCommandLine matches regex shellRegex
// Look for commands that capture/display environment variables or PATH
| where ProcessCommandLine matches regex envRegex or InitiatingProcessCommandLine matches regex envRegex or FileName matches regex envRegex or InitiatingProcessFileName matches regex envRegex
| extend MatchedCommandSource = case(
    ProcessCommandLine matches regex envRegex, "ProcessCommandLine",
    InitiatingProcessCommandLine matches regex envRegex, "InitiatingProcessCommandLine",
    FileName matches regex envRegex, "FileName",
    InitiatingProcessFileName matches regex envRegex, "InitiatingProcessFileName",
    "")
| extend ExactCommand = case(MatchedCommandSource == "ProcessCommandLine", ProcessCommandLine,
                             MatchedCommandSource == "InitiatingProcessCommandLine", InitiatingProcessCommandLine,
                             MatchedCommandSource == "FileName", FileName,
                             MatchedCommandSource == "InitiatingProcessFileName", InitiatingProcessFileName,
                             "")
| project Timestamp, DeviceName, DeviceId, AccountName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExactCommand, MatchedCommandSource
| sort by Timestamp desc

let patterns = dynamic([
  "printenv",
  "/usr/bin/env",
  "/bin/env",
  "echo $path",
  "echo $PATH",
  "cat /proc/self/environ",
  "declare -x",
  "export -p",
  "set -o posix",
  "set -a",
  "/bin/sh -c env",
  "/bin/bash -c env"
]);

// Search process/event tables and restrict to Linux devices via DeviceInfo
union isfuzzy=true DeviceProcessEvents, DeviceEvents
| where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine)
| extend ProcessCommandLine = tostring(ProcessCommandLine), InitiatingProcessCommandLine = tostring(InitiatingProcessCommandLine), DeviceId = tostring(DeviceId)
// Join to DeviceInfo to focus on Linux endpoints (optional but reduces false positives)
| join kind=inner (
    DeviceInfo
    | where isnotempty(OSPlatform) or isnotempty(OSDistribution)
    | where tolower(tostring(OSPlatform)) contains "linux" or tolower(tostring(OSDistribution)) contains "linux"
    | project DeviceId
) on DeviceId
| extend PLC = tolower(ProcessCommandLine), IPLC = tolower(InitiatingProcessCommandLine)
| mv-expand pattern = patterns
| extend patternStr = tostring(pattern)
| where PLC contains tolower(patternStr) or IPLC contains tolower(patternStr)
| extend ObservedCommandLine = iff(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine)
| project TimeGenerated, DeviceName, DeviceId, AccountName, FileName, ProcessId, InitiatingProcessId, InitiatingProcessFileName, ObservedCommandLine, ProcessCommandLine, InitiatingProcessCommandLine, MatchedPattern = patternStr
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Hits = count(), AnyDevice = any(DeviceName), AnyAccount = any(AccountName), AnyInitiatingFile = any(InitiatingProcessFileName) by MatchedPattern = tostring(MatchedPattern), ObservedCommandLine
| order by LastSeen desc
| take 200

let LinuxDeviceInfo = DeviceInfo | where OSPlatform == "Linux" | project DeviceId, DeviceName;
let ShellEvents =
    DeviceProcessEvents
    | where DeviceId in (LinuxDeviceInfo | distinct DeviceId)
    | where InitiatingProcessFileName in ('bash','sh','dash','zsh','ksh','ash','fish')
        or InitiatingProcessCommandLine contains '/bin/bash'
        or InitiatingProcessCommandLine contains '/bin/sh'
        or InitiatingProcessCommandLine contains '/bin/dash'
        or InitiatingProcessCommandLine contains '/bin/zsh'
        or InitiatingProcessCommandLine contains '/bin/ksh'
        or InitiatingProcessCommandLine contains '/bin/ash'
        or InitiatingProcessCommandLine contains '/bin/fish'
        or InitiatingProcessCommandLine contains 'bash'
        or InitiatingProcessCommandLine contains 'sh'
        or InitiatingProcessCommandLine contains 'dash'
        or InitiatingProcessCommandLine contains 'zsh'
        or InitiatingProcessCommandLine contains 'ksh'
        or InitiatingProcessCommandLine contains 'ash'
        or InitiatingProcessCommandLine contains 'fish'
    | project DeviceId, ShellProcessId = ProcessId, ShellTime = TimeGenerated, ShellFileName = InitiatingProcessFileName, ShellCommandLine = InitiatingProcessCommandLine, DeviceName;
let EnvEvents =
    DeviceProcessEvents
    | where DeviceId in (LinuxDeviceInfo | distinct DeviceId)
    | where InitiatingProcessFileName in ('printenv','env')
    | project DeviceId, EnvParentProcessId = InitiatingProcessId, EnvProcessId = ProcessId, EnvTime = TimeGenerated, EnvCommandLine = ProcessCommandLine, EnvFileName = FileName;
ShellEvents
| join kind=inner (EnvEvents) on DeviceId
| where EnvParentProcessId == ShellProcessId
| project TimeGenerated = coalesce(ShellTime, EnvTime), DeviceName, DeviceId, ShellFileName, ShellCommandLine, EnvFileName, EnvCommandLine
| distinct TimeGenerated, DeviceName, DeviceId, ShellFileName, ShellCommandLine, EnvFileName, EnvCommandLine
| sort by TimeGenerated desc
| take 100

DeviceProcessEvents
| where ProcessCommandLine has_any ('env', 'printenv', 'set', 'echo $PATH')
| where InitiatingProcessFileName in~ ('bash', 'sh', 'zsh') or FileName in~ ('bash', 'sh', 'zsh')
| join kind=inner DeviceInfo on DeviceId
| where OSPlatform contains 'Linux'
| project DeviceName, FileName, ProcessCommandLine, Timestamp
| order by Timestamp desc

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (linuxDevices)
| where (ProcessCommandLine contains "env" or ProcessCommandLine contains "printenv" or (ProcessCommandLine contains "echo" and ProcessCommandLine contains "$PATH"))
| where FileName has_any ("bash", "sh", "zsh")
| project TimeGenerated, DeviceName, ProcessCommandLine
| order by TimeGenerated desc
| take 10;

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| join kind=inner (
    DeviceInfo
    | where OSPlatform == "Linux"
    | project DeviceId
) on DeviceId
| where isnotempty(ProcessCommandLine)
| where ProcessCommandLine has_any ("env", "printenv", "echo $PATH", "cat /proc/")
| order by TimeGenerated desc
| project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ProcessCommandLine
| limit 50

DeviceProcessEvents
| join kind=inner (
    DeviceInfo
    | where OSPlatform =~ "Linux"
    | distinct DeviceId
) on DeviceId
| where ActionType == "ProcessCreated"
| where tolower(ProcessCommandLine) has_any ("env", "printenv", "echo $path", "cat /etc/environment")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
| order by TimeGenerated desc
| limit 100

// --- Linux environment & PATH discovery ----------------------------------
let LinuxDevices = DeviceInfo
| where OSPlatform =~ "Linux"
| project DeviceId;
DeviceProcessEvents
| where DeviceId in (LinuxDevices)
| where ActionType == "ProcessCreated"
// 1) Direct utilities that dump the environment
| where FileName       in~ ("env", "printenv")
      // 2) OR a shell that was used to run one of those utilities / echo $PATH
      or (FileName      in~ ("bash","sh","dash","zsh","ksh")
          and ProcessCommandLine matches regex @"(?i)\b(env|printenv)\b|\$PATH")
| project TimeGenerated,
          DeviceName,
          AccountName,
          ParentProcess   = strcat(InitiatingProcessFileName, " ", InitiatingProcessCommandLine),
          ChildProcess    = strcat(FileName, " ", ProcessCommandLine)
| order by TimeGenerated desc
// If you only need the unique discovery commands, uncomment the next line
//| summarize by ChildProcess

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where isnotempty(ProcessCommandLine)
| where ProcessCommandLine has_any ("env", "printenv", "$PATH")
| where FileName endswith "sh" or FileName endswith "bash" or FileName endswith "zsh"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine
| sort by TimeGenerated desc
| take 10

let linuxDevices = DeviceInfo
| where OSPlatform =~ "Linux"
| project DeviceId;

DeviceProcessEvents
| where DeviceId in (linuxDevices)
| where InitiatingProcessFileName in~ ("bash", "sh", "zsh")
| where ProcessCommandLine matches regex @"\b(env|printenv|set)\b|\becho\s+\$PATH\b"
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine
| sort by TimeGenerated desc