An alert has surfaced on a Linux host indicating a potentially malicious recursive delete operation. Investigate process events to find out which directory name was completely removed.

DeviceFileEvents
| where ActionType == "FileDeleted"
| summarize CountOfDeletedFiles = count() by DeviceName, FolderPath, InitiatingProcessCommandLine
| order by CountOfDeletedFiles desc

DeviceProcessEvents
| where FileName contains 'bash' or FileName contains 'sh'
| where ProcessCommandLine contains 'rm' and ProcessCommandLine contains '-rf'
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath

DeviceProcessEvents
| where ProcessCommandLine has 'rm' and ProcessCommandLine has '-rf'
| extend regex = @'rm\s+-rf\s+([^\s]+)'
| extend RemovedDirectory = extract(regex, 1, ProcessCommandLine)
| where isnotempty(RemovedDirectory)
| summarize DeleteCount=count(), MinTime=min(TimeGenerated), MaxTime=max(TimeGenerated) by DeviceName, RemovedDirectory
| sort by DeleteCount desc, MaxTime desc

DeviceProcessEvents
| where ProcessCommandLine has_any ('rm -rf', 'rm -r')
| extend DeletedDirectory = extract(@'rm -rf? \*?(\/[^\s]+)', 1, ProcessCommandLine)
| where isnotempty(DeletedDirectory)
| summarize Count = count() by DeletedDirectory
| order by Count desc
| take 10

DeviceProcessEvents
| where ActionType has_any ("FileDeleted", "Delete", "Removed", "WriteFile", "RemovedDirectory", "DeleteFile", "FileDelete") or ProcessCommandLine has_any ("rm -rf", "rm -r", "unlink", "rmdir")
| where isnotempty(FolderPath) or isnotempty(FileName)
| extend FullPath = strcat(FolderPath, iff(FolderPath endswith "/", "", "/"), coalesce(FileName, ""))
// Identify candidate events which look like directory deletion: FileName empty or '.' or action mentioning directory
| extend IsDirDelete = iff(FileName == "" or FileName == "." or ActionType has "Directory" or ActionType has "Folder" or FolderPath endswith "/" and (ProcessCommandLine has "rm -rf" or ProcessCommandLine has "rm -r"), 1, 0)
| where IsDirDelete == 1 or ProcessCommandLine has "rm -rf"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, FolderPath, FileName, FullPath
| summarize Events = count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by RemovedDirectory=coalesce(FullPath, FolderPath), DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by LastSeen desc
| limit 50

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has 'rm'
| where ProcessCommandLine matches regex @'rm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+|--recursive\s+)[^\s]*'
| join kind=leftouter DeviceInfo on DeviceId
| where OSPlatform contains 'Linux'
| extend TargetDirectory = extract(@'rm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+|--recursive\s+)([^\s]+)', 2, ProcessCommandLine)
| where isnotempty(TargetDirectory)
| project Timestamp, DeviceName, ProcessCommandLine, TargetDirectory, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
| limit 50

let linuxDevices = DeviceInfo | where OSPlatform == 'Linux' | distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (linuxDevices)
| where ProcessCommandLine has "rm" and (ProcessCommandLine has "-r" or ProcessCommandLine has "-rf")
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine
| order by Timestamp desc
| summarize RemovedDirectories = make_set(FolderPath) by DeviceName

DeviceInfo
| where OSPlatform == "Linux"
| distinct DeviceId, DeviceName
| join kind=inner (
    DeviceProcessEvents
    | where ActionType == "ProcessCreated"
    | where ProcessCommandLine has_any ("rm", "-r", "--recursive")
    // Attempt to extract the directory following an "rm -r" or "rm --recursive" pattern
    | extend RemovedDirectory = extract(@"(?:rm\s+.*-r\S*\s+)([^\s]+)", 1, ProcessCommandLine)
    | where isnotempty(RemovedDirectory)
    | project TimeGenerated, DeviceId, ProcessCommandLine, RemovedDirectory
) on DeviceId
| project TimeGenerated, DeviceName, RemovedDirectory, ProcessCommandLine
| order by TimeGenerated desc

DeviceInfo
| where OSPlatform == "Linux"
| join kind=inner (
    DeviceFileEvents
    | where ActionType contains "Delete"
    | where InitiatingProcessCommandLine has_any ("rm -r", "rm -rf")
) on DeviceId
| project TimeGenerated, DeviceName, ActionType, FolderPath, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine has "rm -rf"
| extend RemovedDirectory = extract(@"rm\s+-rf\s+(\S+)", 1, ProcessCommandLine)
| where isnotempty(RemovedDirectory)
| project TimeGenerated, DeviceName, ProcessCommandLine, RemovedDirectory
| order by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessCommandLine has "rm" and InitiatingProcessCommandLine has "-rf"
| extend RemovedDir = extract(@"rm\s+-rf\s+(\S+)", 1, InitiatingProcessCommandLine)
| where isnotempty(RemovedDir)
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, RemovedDir, FolderPath
| order by TimeGenerated desc