Question Analysis

DeviceFileEvents | where ActionType == "FileDeleted" | summarize CountOfDeletedFiles = count() by DeviceName, FolderPath, InitiatingProcessCommandLine | order by CountOfDeletedFiles desc

DeviceProcessEvents | where FileName contains 'bash' or FileName contains 'sh' | where ProcessCommandLine contains 'rm' and ProcessCommandLine contains '-rf' | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath

DeviceProcessEvents | where ProcessCommandLine has 'rm' and ProcessCommandLine has '-rf' | extend regex = @'rm\s+-rf\s+([^\s]+)' | extend RemovedDirectory = extract(regex, 1, ProcessCommandLine) | where isnotempty(RemovedDirectory) | summarize DeleteCount=count(), MinTime=min(TimeGenerated), MaxTime=max(TimeGenerated) by DeviceName, RemovedDirectory | sort by DeleteCount desc, MaxTime desc

DeviceProcessEvents | where ProcessCommandLine has_any ('rm -rf', 'rm -r') | extend DeletedDirectory = extract(@'rm -rf? \*?(\/[^\s]+)', 1, ProcessCommandLine) | where isnotempty(DeletedDirectory) | summarize Count = count() by DeletedDirectory | order by Count desc | take 10

DeviceProcessEvents | where ActionType has_any ("FileDeleted", "Delete", "Removed", "WriteFile", "RemovedDirectory", "DeleteFile", "FileDelete") or ProcessCommandLine has_any ("rm -rf", "rm -r", "unlink", "rmdir") | where isnotempty(FolderPath) or isnotempty(FileName) | extend FullPath = strcat(FolderPath, iff(FolderPath endswith "/", "", "/"), coalesce(FileName, "")) // Identify candidate events which look like directory deletion: FileName empty or '.' or action mentioning directory | extend IsDirDelete = iff(FileName == "" or FileName == "." or ActionType has "Directory" or ActionType has "Folder" or FolderPath endswith "/" and (ProcessCommandLine has "rm -rf" or ProcessCommandLine has "rm -r"), 1, 0) | where IsDirDelete == 1 or ProcessCommandLine has "rm -rf" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, FolderPath, FileName, FullPath | summarize Events = count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by RemovedDirectory=coalesce(FullPath, FolderPath), DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine | order by LastSeen desc | limit 50

DeviceProcessEvents | where TimeGenerated > ago(7d) | where ProcessCommandLine has 'rm' | where ProcessCommandLine matches regex @'rm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+|--recursive\s+)[^\s]*' | join kind=leftouter DeviceInfo on DeviceId | where OSPlatform contains 'Linux' | extend TargetDirectory = extract(@'rm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+|--recursive\s+)([^\s]+)', 2, ProcessCommandLine) | where isnotempty(TargetDirectory) | project Timestamp, DeviceName, ProcessCommandLine, TargetDirectory, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc | limit 50

let linuxDevices = DeviceInfo | where OSPlatform == 'Linux' | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where ProcessCommandLine has "rm" and (ProcessCommandLine has "-r" or ProcessCommandLine has "-rf") | project Timestamp, DeviceName, FolderPath, ProcessCommandLine | order by Timestamp desc | summarize RemovedDirectories = make_set(FolderPath) by DeviceName

DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId, DeviceName | join kind=inner ( DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has_any ("rm", "-r", "--recursive") // Attempt to extract the directory following an "rm -r" or "rm --recursive" pattern | extend RemovedDirectory = extract(@"(?:rm\s+.*-r\S*\s+)([^\s]+)", 1, ProcessCommandLine) | where isnotempty(RemovedDirectory) | project TimeGenerated, DeviceId, ProcessCommandLine, RemovedDirectory ) on DeviceId | project TimeGenerated, DeviceName, RemovedDirectory, ProcessCommandLine | order by TimeGenerated desc

DeviceInfo | where OSPlatform == "Linux" | join kind=inner ( DeviceFileEvents | where ActionType contains "Delete" | where InitiatingProcessCommandLine has_any ("rm -r", "rm -rf") ) on DeviceId | project TimeGenerated, DeviceName, ActionType, FolderPath, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "rm -rf" | extend RemovedDirectory = extract(@"rm\s+-rf\s+(\S+)", 1, ProcessCommandLine) | where isnotempty(RemovedDirectory) | project TimeGenerated, DeviceName, ProcessCommandLine, RemovedDirectory | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has "rm" and InitiatingProcessCommandLine has "-rf" | extend RemovedDir = extract(@"rm\s+-rf\s+(\S+)", 1, InitiatingProcessCommandLine) | where isnotempty(RemovedDir) | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, RemovedDir, FolderPath | order by TimeGenerated desc