Question Analysis

let command_discovery = dynamic(["env", "printenv"]); let binaries = dynamic(["sh", "csh", "zsh", "dash", "bash", "rbash"]); DeviceProcessEvents | where ActionType has_any ("CreateProcess", "ForkEvent", "ProcessCreated") | where FileName has_any (binaries) | where ProcessCommandLine has_any (command_discovery) | extend CommandLine = tostring(ProcessCommandLine) | summarize argCount = count(), processNames = make_set(ProcessCommandLine,1000) by FileName, CommandLine | sort by argCount desc // Uncomment below for exact execution time and parent process info: // | summarize argCount = count(), processNames = make_set(ProcessCommandLine,1000) by FileName, FolderPath, Timestamp, InitiatingProcessParentFileName // | mv-expand processNames // | extend CommandLine = tostring(processNames) // | project-away processNames

DeviceProcessEvents | where DeviceName contains "linux" or InitiatingProcessFileName in ("bash", "sh", "zsh") | where ProcessCommandLine has_any ("env", "printenv", "set") | project DeviceName, ProcessCommandLine, ProcessCreationTime | order by ProcessCreationTime desc

DeviceProcessEvents | where FolderPath contains '/bin' or FolderPath contains '/usr/bin' or FolderPath contains 'bin/' | where ProcessCommandLine contains 'printenv' or ProcessCommandLine contains 'env' or ProcessCommandLine contains 'set' | where ProcessCommandLine contains '| grep' or ProcessCommandLine contains 'grep' | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessId

DeviceProcessEvents | where InitiatingProcessCommandLine has_any ("env", "printenv", "echo $PATH") | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, AccountName, AccountDomain, ProcessCommandLine

let shells = pack_array("sh","bash","dash","zsh","ksh","busybox","fish"); let linuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | summarize arg_max(TimeGenerated, *) by DeviceId | project DeviceId; let env_rx = @"(?i)\b(env|printenv|export\s+-p|set)\b"; let path_rx = @"(?i)(\$PATH|\bPATH=|\bprintenv\s+PATH\b|\becho\s+\$PATH\b|\bgrep\s+-i\s+\^?PATH\b)"; DeviceProcessEvents | where ActionType == "ProcessCreated" | where DeviceId in (linuxDevices) | where FileName in~ (shells) or ProcessCommandLine has_any ("sh -c","bash -c","dash -c","zsh -c","ksh -c","busybox sh -c","/bin/sh -c","/usr/bin/sh -c","/bin/bash -c","/usr/bin/bash -c") | extend ShellCmd = coalesce( extract(@"(?i)(?:^|\s)-{0,2}c\s+(['""])(.*?)\1", 2, ProcessCommandLine), extract(@"(?i)(?:^|\s)-{0,2}c\s+(.+)$", 1, ProcessCommandLine) ) | extend ExactCommand = trim(" ", coalesce(ShellCmd, ProcessCommandLine)) | where InitiatingProcessFileName !in~ (shells) | where InitiatingProcessFileName !in~ (pack_array("systemd","init","kworker","kswapd","kthreadd")) | where ExactCommand matches regex env_rx and ExactCommand matches regex path_rx | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ExactCommand | order by TimeGenerated desc

let shellRegex = @"(?i)^(bash|sh|zsh|dash|ksh|ash|/bin/(bash|sh)|/usr/bin/(bash|sh))$"; let envRegex = @"(?i)(\benv\b|\bprintenv\b|echo\s+\$PATH|cat\s+/proc/(\w+|self)/environ|/proc/self/environ|\bset\b|printenv\s+-)"; DeviceProcessEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) // Ensure the process or its initiator is a shell | where FileName matches regex shellRegex or InitiatingProcessFileName matches regex shellRegex or ProcessCommandLine matches regex shellRegex or InitiatingProcessCommandLine matches regex shellRegex // Look for commands that capture/display environment variables or PATH | where ProcessCommandLine matches regex envRegex or InitiatingProcessCommandLine matches regex envRegex or FileName matches regex envRegex or InitiatingProcessFileName matches regex envRegex | extend MatchedCommandSource = case( ProcessCommandLine matches regex envRegex, "ProcessCommandLine", InitiatingProcessCommandLine matches regex envRegex, "InitiatingProcessCommandLine", FileName matches regex envRegex, "FileName", InitiatingProcessFileName matches regex envRegex, "InitiatingProcessFileName", "") | extend ExactCommand = case(MatchedCommandSource == "ProcessCommandLine", ProcessCommandLine, MatchedCommandSource == "InitiatingProcessCommandLine", InitiatingProcessCommandLine, MatchedCommandSource == "FileName", FileName, MatchedCommandSource == "InitiatingProcessFileName", InitiatingProcessFileName, "") | project Timestamp, DeviceName, DeviceId, AccountName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExactCommand, MatchedCommandSource | sort by Timestamp desc

let patterns = dynamic([ "printenv", "/usr/bin/env", "/bin/env", "echo $path", "echo $PATH", "cat /proc/self/environ", "declare -x", "export -p", "set -o posix", "set -a", "/bin/sh -c env", "/bin/bash -c env" ]); // Search process/event tables and restrict to Linux devices via DeviceInfo union isfuzzy=true DeviceProcessEvents, DeviceEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | extend ProcessCommandLine = tostring(ProcessCommandLine), InitiatingProcessCommandLine = tostring(InitiatingProcessCommandLine), DeviceId = tostring(DeviceId) // Join to DeviceInfo to focus on Linux endpoints (optional but reduces false positives) | join kind=inner ( DeviceInfo | where isnotempty(OSPlatform) or isnotempty(OSDistribution) | where tolower(tostring(OSPlatform)) contains "linux" or tolower(tostring(OSDistribution)) contains "linux" | project DeviceId ) on DeviceId | extend PLC = tolower(ProcessCommandLine), IPLC = tolower(InitiatingProcessCommandLine) | mv-expand pattern = patterns | extend patternStr = tostring(pattern) | where PLC contains tolower(patternStr) or IPLC contains tolower(patternStr) | extend ObservedCommandLine = iff(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, DeviceId, AccountName, FileName, ProcessId, InitiatingProcessId, InitiatingProcessFileName, ObservedCommandLine, ProcessCommandLine, InitiatingProcessCommandLine, MatchedPattern = patternStr | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Hits = count(), AnyDevice = any(DeviceName), AnyAccount = any(AccountName), AnyInitiatingFile = any(InitiatingProcessFileName) by MatchedPattern = tostring(MatchedPattern), ObservedCommandLine | order by LastSeen desc | take 200

let LinuxDeviceInfo = DeviceInfo | where OSPlatform == "Linux" | project DeviceId, DeviceName; let ShellEvents = DeviceProcessEvents | where DeviceId in (LinuxDeviceInfo | distinct DeviceId) | where InitiatingProcessFileName in ('bash','sh','dash','zsh','ksh','ash','fish') or InitiatingProcessCommandLine contains '/bin/bash' or InitiatingProcessCommandLine contains '/bin/sh' or InitiatingProcessCommandLine contains '/bin/dash' or InitiatingProcessCommandLine contains '/bin/zsh' or InitiatingProcessCommandLine contains '/bin/ksh' or InitiatingProcessCommandLine contains '/bin/ash' or InitiatingProcessCommandLine contains '/bin/fish' or InitiatingProcessCommandLine contains 'bash' or InitiatingProcessCommandLine contains 'sh' or InitiatingProcessCommandLine contains 'dash' or InitiatingProcessCommandLine contains 'zsh' or InitiatingProcessCommandLine contains 'ksh' or InitiatingProcessCommandLine contains 'ash' or InitiatingProcessCommandLine contains 'fish' | project DeviceId, ShellProcessId = ProcessId, ShellTime = TimeGenerated, ShellFileName = InitiatingProcessFileName, ShellCommandLine = InitiatingProcessCommandLine, DeviceName; let EnvEvents = DeviceProcessEvents | where DeviceId in (LinuxDeviceInfo | distinct DeviceId) | where InitiatingProcessFileName in ('printenv','env') | project DeviceId, EnvParentProcessId = InitiatingProcessId, EnvProcessId = ProcessId, EnvTime = TimeGenerated, EnvCommandLine = ProcessCommandLine, EnvFileName = FileName; ShellEvents | join kind=inner (EnvEvents) on DeviceId | where EnvParentProcessId == ShellProcessId | project TimeGenerated = coalesce(ShellTime, EnvTime), DeviceName, DeviceId, ShellFileName, ShellCommandLine, EnvFileName, EnvCommandLine | distinct TimeGenerated, DeviceName, DeviceId, ShellFileName, ShellCommandLine, EnvFileName, EnvCommandLine | sort by TimeGenerated desc | take 100

DeviceProcessEvents | where ProcessCommandLine has_any ('env', 'printenv', 'set', 'echo $PATH') | where InitiatingProcessFileName in~ ('bash', 'sh', 'zsh') or FileName in~ ('bash', 'sh', 'zsh') | join kind=inner DeviceInfo on DeviceId | where OSPlatform contains 'Linux' | project DeviceName, FileName, ProcessCommandLine, Timestamp | order by Timestamp desc

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where (ProcessCommandLine contains "env" or ProcessCommandLine contains "printenv" or (ProcessCommandLine contains "echo" and ProcessCommandLine contains "$PATH")) | where FileName has_any ("bash", "sh", "zsh") | project TimeGenerated, DeviceName, ProcessCommandLine | order by TimeGenerated desc | take 10;

DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | project DeviceId ) on DeviceId | where isnotempty(ProcessCommandLine) | where ProcessCommandLine has_any ("env", "printenv", "echo $PATH", "cat /proc/") | order by TimeGenerated desc | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ProcessCommandLine | limit 50

DeviceProcessEvents | join kind=inner ( DeviceInfo | where OSPlatform =~ "Linux" | distinct DeviceId ) on DeviceId | where ActionType == "ProcessCreated" | where tolower(ProcessCommandLine) has_any ("env", "printenv", "echo $path", "cat /etc/environment") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc | limit 100

// --- Linux environment & PATH discovery ---------------------------------- let LinuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ActionType == "ProcessCreated" // 1) Direct utilities that dump the environment | where FileName in~ ("env", "printenv") // 2) OR a shell that was used to run one of those utilities / echo $PATH or (FileName in~ ("bash","sh","dash","zsh","ksh") and ProcessCommandLine matches regex @"(?i)\b(env|printenv)\b|\$PATH") | project TimeGenerated, DeviceName, AccountName, ParentProcess = strcat(InitiatingProcessFileName, " ", InitiatingProcessCommandLine), ChildProcess = strcat(FileName, " ", ProcessCommandLine) | order by TimeGenerated desc // If you only need the unique discovery commands, uncomment the next line //| summarize by ChildProcess

DeviceProcessEvents | where ActionType == "ProcessCreated" | where isnotempty(ProcessCommandLine) | where ProcessCommandLine has_any ("env", "printenv", "$PATH") | where FileName endswith "sh" or FileName endswith "bash" or FileName endswith "zsh" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine | sort by TimeGenerated desc | take 10

let linuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where InitiatingProcessFileName in~ ("bash", "sh", "zsh") | where ProcessCommandLine matches regex @"\b(env|printenv|set)\b|\becho\s+\$PATH\b" | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine | sort by TimeGenerated desc