Question Analysis

DeviceProcessEvents | where ActionType == 'ProcessCreated' | where ProcessCommandLine has_any ('systemctl list-units', 'systemctl --type=service', 'service --status-all', 'initctl list', 'rc-status', 'chkconfig --list') | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FileName, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has_any ("systemctl", "service", "ps", "netstat", "ss", "chkconfig", "systemd") | where Timestamp between (startofday(ago(30d)) .. endofday(now())) | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessCreationTime | order by TimeGenerated desc | take 50

DeviceProcessEvents | where ProcessCommandLine has_any ('systemctl list-units', 'service --status-all', 'ps aux', 'ps -ef') | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine | order by TimeGenerated desc

let linux_devices = DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId, DeviceName, OSPlatform, MachineGroup; DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner (linux_devices) on DeviceId | where ( // systemctl variants that list services (tolower(FileName) == "systemctl" and ( ProcessCommandLine has "list-units" or ProcessCommandLine has "list-unit-files" or ProcessCommandLine has "--type=service" or ProcessCommandLine has "-t service" or ProcessCommandLine has "--type service" or ProcessCommandLine has " -a" // default action (list-units) with all or ProcessCommandLine has " --all" )) or // SysV service enumeration (tolower(FileName) == "service" and ProcessCommandLine has "--status-all") or // chkconfig list (tolower(FileName) == "chkconfig" and ProcessCommandLine has "--list") or // Upstart list (tolower(FileName) == "initctl" and ProcessCommandLine has "list") or // OpenRC (tolower(FileName) == "rc-update" and ProcessCommandLine has "show") or (tolower(FileName) == "rc-service" and (ProcessCommandLine has " -l" or ProcessCommandLine has " --list")) or (tolower(FileName) == "rc-status") or // runit (tolower(FileName) == "sv" and ProcessCommandLine has "status") ) | extend MatchHint = case( tolower(FileName) == "systemctl" and ProcessCommandLine has "list-units", "systemctl list-units", tolower(FileName) == "systemctl" and ProcessCommandLine has "list-unit-files", "systemctl list-unit-files", tolower(FileName) == "systemctl" and (ProcessCommandLine has "--type=service" or ProcessCommandLine has "-t service" or ProcessCommandLine has "--type service"), "systemctl --type=service", tolower(FileName) == "systemctl" and (ProcessCommandLine has " -a" or ProcessCommandLine has " --all"), "systemctl -a/--all", tolower(FileName) == "service" and ProcessCommandLine has "--status-all", "service --status-all", tolower(FileName) == "chkconfig" and ProcessCommandLine has "--list", "chkconfig --list", tolower(FileName) == "initctl" and ProcessCommandLine has "list", "initctl list", tolower(FileName) == "rc-update" and ProcessCommandLine has "show", "rc-update show", tolower(FileName) == "rc-service" and (ProcessCommandLine has " -l" or ProcessCommandLine has " --list"), "rc-service -l/--list", tolower(FileName) == "rc-status", "rc-status", tolower(FileName) == "sv" and ProcessCommandLine has "status", "sv status", "other") | project Timestamp, DeviceName, AccountName, AccountUpn, FileName, ProcessCommandLine, MatchHint, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId, MachineGroup | order by Timestamp desc

// Search for common Linux service enumeration commands across process events and device events let service_patterns = dynamic([ "systemctl list-units", "systemctl --type=service", "systemctl status", "service --status-all", "ls /etc/init.d", "chkconfig --list", "svcs -a", "rcsvcs -a", "systemctl list-units --type=service", "service --status-all 2>&1", "systemctl --all", "systemctl --type=service --all", "systemctl list-unit-files", "systemctl --failed" ]); // DeviceProcessEvents (recommended for process command lines) let dpe = DeviceProcessEvents | where TimeGenerated >= ago(30d) | where isnotempty(ProcessCommandLine) | where FileName has_any ("systemctl","service","chkconfig","svcs","rcsvcs","ls","systemctl") | where array_length(service_patterns) == array_length(service_patterns) or true | where ( ProcessCommandLine has "systemctl" or ProcessCommandLine has "service --status-all" or ProcessCommandLine has "/etc/init.d" or ProcessCommandLine has "chkconfig" or ProcessCommandLine has "svcs -a" or ProcessCommandLine has "rcsvcs -a" ) | extend Command = ProcessCommandLine, Account = tostring(AccountName) | project TimeGenerated, DeviceName, FileName, ProcessId, Command, Account, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime, ReportId, TenantId ; // DeviceEvents may also contain process command lines let de = DeviceEvents | where TimeGenerated >= ago(30d) | where isnotempty(ProcessCommandLine) | where ProcessCommandLine has_any ("systemctl","service","chkconfig","svcs","rcsvcs","/etc/init.d","ls /etc/init.d") | extend Command = ProcessCommandLine, Account = tostring(AccountName) | project TimeGenerated, DeviceName, FileName, ProcessId, Command, Account, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime, ReportId, TenantId ; // Union results and deduplicate by Command + Device + ProcessId union dpe, de | sort by TimeGenerated desc | extend match = case( Command has "systemctl", "systemctl", Command has "service --status-all", "service", Command has "/etc/init.d", "init.d", Command has "chkconfig", "chkconfig", Command has "svcs", "svcs", Command has "rcsvcs", "rcsvcs", Command has "launchctl", "launchctl", "other") | summarize FirstSeenUtc = min(TimeGenerated), LastSeenUtc = max(TimeGenerated), count() by Command, DeviceName, FileName, ProcessId, Account, InitiatingProcessFileName, InitiatingProcessCommandLine | sort by LastSeenUtc desc | project LastSeenUtc, FirstSeenUtc, DeviceName, FileName, ProcessId, Account, Command, InitiatingProcessFileName, InitiatingProcessCommandLine, count_ | take 200

let linuxDevices = DeviceInfo | where isnotempty(DeviceId) | where tolower(tostring(OSPlatform)) contains "linux" or tolower(tostring(OSDistribution)) contains "linux" or tolower(tostring(OSVersionInfo)) contains "linux" | distinct DeviceId; let procEvents = union ( DeviceProcessEvents | project TimeGenerated, DeviceId, DeviceName, AccountName, AccountDomain=AccountDomain, FileName, ProcessId, ProcessCreationTime, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, ReportId ), ( DeviceEvents | project TimeGenerated, DeviceId, DeviceName, AccountName, AccountDomain=AccountDomain, FileName, ProcessId=ProcessId, ProcessCreationTime=ProcessCreationTime, ProcessCommandLine=ProcessCommandLine, InitiatingProcessFileName=InitiatingProcessFileName, InitiatingProcessId=InitiatingProcessId, InitiatingProcessCommandLine=InitiatingProcessCommandLine, InitiatingProcessAccountName=InitiatingProcessAccountName, InitiatingProcessAccountDomain=InitiatingProcessAccountDomain, ReportId ); procEvents | where DeviceId in (linuxDevices) | where isnotempty(ProcessCommandLine) | extend CommandLine = trim(" '\"`", tostring(ProcessCommandLine)) | extend lcmd = tolower(CommandLine) | where lcmd contains "systemctl" or lcmd contains "service --status-all" or lcmd contains "/etc/init.d" or lcmd contains "chkconfig" or lcmd contains "initctl" or lcmd contains "list-units" or lcmd contains "list-unit-files" or lcmd contains "--type=service" or (lcmd contains "ps aux" and lcmd contains "grep") or (lcmd contains "ps -ef" and lcmd contains "grep") or lcmd contains "rc-service" or lcmd contains "rc-status" or lcmd contains "svcadm" or lcmd contains "ss -ltnp" or lcmd contains "ss -tulpn" or lcmd contains "netstat -tuln" or lcmd contains "/sbin/service" | summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Devices = make_set(DeviceName, 20), DeviceIds = make_set(DeviceId, 20), Accounts = make_set(AccountName, 20), AnyProcessId = any(ProcessId), AnyFile = any(FileName), AnyInitiatingProcess = any(InitiatingProcessFileName) by CommandLine | sort by LastSeen desc | limit 500

DeviceProcessEvents | where ( InitiatingProcessCommandLine contains_cs "systemctl" or InitiatingProcessCommandLine contains_cs "service" or ProcessCommandLine contains_cs "systemctl" or ProcessCommandLine contains_cs "service" or InitiatingProcessFileName contains_cs "systemctl" or InitiatingProcessFileName contains_cs "service" or FileName contains_cs "systemctl" or FileName contains_cs "service" ) | where ( InitiatingProcessCommandLine contains_cs "list-units" or InitiatingProcessCommandLine contains_cs "list-unit-files" or InitiatingProcessCommandLine contains_cs "--status-all" or ProcessCommandLine contains_cs "list-units" or ProcessCommandLine contains_cs "list-unit-files" or ProcessCommandLine contains_cs "--status-all" or InitiatingProcessFileName contains_cs "systemctl" or FileName contains_cs "systemctl" ) | extend FullCommand = coalesce(InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessFileName, FileName) | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessId, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessFileName, FileName, FullCommand | sort by TimeGenerated desc | take 100

DeviceProcessEvents | where isnotempty(InitiatingProcessCommandLine) or isnotempty(ProcessCommandLine) | extend CmdLine = tostring(coalesce(InitiatingProcessCommandLine, ProcessCommandLine)) | where CmdLine contains "systemctl" or CmdLine contains "service" | where CmdLine contains "systemctl list-units" or CmdLine contains "systemctl list-unit-files" or CmdLine contains "systemctl list-units --type=service" or CmdLine contains "systemctl list-units -t service" or CmdLine contains "systemctl status" or CmdLine contains "systemctl list-unit-files" or CmdLine contains "service --status-all" | project TimeGenerated, DeviceName, ProcessId, InitiatingProcessId, InitiatingProcessFileName, CmdLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCreationTime, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has_any('service', 'systemctl', 'list-units') | join kind=inner (DeviceInfo | where OSPlatform == 'Linux' | project DeviceId) on DeviceId | summarize arg_max(TimeGenerated, *) by ProcessCommandLine | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc | take 100

DeviceProcessEvents | where DeviceId in (DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId) | where FileName in~ ("service", "systemctl", "initctl", "chkconfig", "rc-update") or ProcessCommandLine has_any ("systemctl list", "list-units", "--status-all", "initctl list", "chkconfig", "rc-update") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, SHA256, InitiatingProcessCommandLine | order by TimeGenerated desc

// --------------- Service enumeration investigation (Linux) --------------- // 1) Identify Linux endpoints so we do not pick up Windows service-related utilities let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | project DeviceId; // 2) Known utilities used to enumerate services on *nix systems let svc_enum_utilities = dynamic(["systemctl","service","chkconfig","initctl","rc-service"]); // 3) Common command-line phrases that indicate the intent is *listing* services let svc_enum_phrases = dynamic([ "systemctl list", // systemd service listing "systemctl --type=service", "systemctl --all", "service --status-all", // SysV-style listing "service -e", // BusyBox variant "chkconfig --list", // RHEL/CentOS "initctl list", // Upstart "rc-service -l", // OpenRC "rc-service list" // OpenRC alternate ]); DeviceProcessEvents | where DeviceId in (LinuxDevices) // keep only Linux hosts | where ActionType == "ProcessCreated" // process start events | where FileName in~ (svc_enum_utilities) // executable of interest (case-insensitive) or ProcessCommandLine has_any (svc_enum_phrases) // or explicit enumeration flags // 4) Return the details the analyst cares about | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, // <— full command that was run InitiatingProcessAccountName, InitiatingProcessCommandLine, FolderPath, ProcessId, InitiatingProcessFileName, InitiatingProcessId, SHA256, ReportId | order by TimeGenerated desc

DeviceProcessEvents | where isnotempty(ProcessCommandLine) | where ProcessCommandLine matches regex @'.*(systemctl\s+list-units|service\s+--status-all|chkconfig).*' | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc | limit 100

let LinuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | summarize by DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ProcessCommandLine matches regex @"\b(systemctl|chkconfig|service|update-rc\.d)\b" and ProcessCommandLine has_any ("list","status","--status-all") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, FileName, ProcessId, ProcessCommandLine | order by TimeGenerated desc