Question Analysis

DeviceProcessEvents | where tolower(FolderPath) contains "perl" | where FileName in~ ("cpanm","perlbrew","perl-build","carton","cpan","plenv","ack","perl") | project ProcessId, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime

DeviceProcessEvents | where (InitiatingProcessFileName has_any ('cpan','cpanm') or InitiatingProcessCommandLine contains 'cpan' or InitiatingProcessCommandLine contains 'cpanm') | where ProcessCommandLine has_any ('sh', 'bash', 'zsh') | project DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where InitiatingProcessFileName has_any ('cpan', 'cpanm', 'cpanp') or InitiatingProcessCommandLine has_any ('cpan', 'cpanm', 'cpanp') | where FileName has_any ('sh', 'bash', 'dash', 'zsh', 'ksh') | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, FolderPath, InitiatingProcessFolderPath

DeviceProcessEvents | where InitiatingProcessCommandLine contains ".sh" | summarize processCommandLineCount=count() by InitiatingProcessCommandLine, DeviceName, AccountName | extend timestamp = now() | sort by processCommandLineCount desc | extend AccountName = tostring(split(AccountName, "@")[0]), DnsDomain = tostring(split(AccountName, "@")[1]) | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, ".")) | extend DNSDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName) // Please uncomment below to filter the results based on a specific domain/hostname // | where DNSDomain in ("<your domain/host to be filtered>") or HostName in ("<your domain/host to be filtered>") // Please uncomment below to filter the results based on a specific account name // | where AccountName in ("<your account to be filtered>")

DeviceProcessEvents | where FileName in ("cpan", "cpanm") or ProcessCommandLine has_any ("cpan", "cpanm") | where InitiatingProcessFileName in ("sh", "bash", "/bin/sh", "/bin/bash") or InitiatingProcessCommandLine has_any ("sh", "bash", "/bin/sh", "/bin/bash") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains 'perl' or ProcessCommandLine contains '/bin/sh' or ProcessCommandLine contains 'bash' | where ProcessCommandLine matches regex '(?i)escape|restricted|shell|perl' | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, ProcessId, InitiatingProcessParentFileName, InitiatingProcessParentId, InitiatingProcessParentCreationTime | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName =~ "perl" or InitiatingProcessFileName =~ "cpan" | where FileName has_any ("bash", "sh", "shell") or ProcessCommandLine has_any ("bash", "sh", "shell") | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

DeviceProcessEvents | where TimeGenerated > ago(7d) | where (ProcessCommandLine contains 'perl' or ProcessCommandLine contains 'cpan') | where (ProcessCommandLine contains 'sh' or ProcessCommandLine contains 'bash' or ProcessCommandLine contains 'shell') | join kind=inner ( DeviceInfo | where OSPlatform == 'Linux' ) on DeviceId | project DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, ProcessCreationTime, DeviceId | order by ProcessCreationTime desc | limit 50

DeviceProcessEvents | where FolderPath startswith "/" | where InitiatingProcessFileName has_any ("perl", "cpan", "cpanm") | where ProcessCommandLine has_any ("/bin/sh", "system", "exec", "shell") | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, ProcessId | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessCommandLine has_any ("perl", "cpan", "cpanm") | where FileName in~ ("sh", "bash", "zsh", "ksh", "dash") | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName in~ ("sh", "bash", "dash", "zsh", "csh", "ksh") // Identify newly created shell-like processes | where InitiatingProcessFileName in~ ("cpan", "cpanm", "perl") or InitiatingProcessCommandLine has_any ("cpan", "cpanm") // Filter for shells spawned by cpan, cpanm, or perl | project TimeGenerated, DeviceName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, AccountName | order by TimeGenerated desc

DeviceProcessEvents | where (tolower(InitiatingProcessFileName) has_any ("cpan", "cpanm") or tolower(InitiatingProcessCommandLine) has_any ("cpan", "cpanm")) | where (tolower(FileName) has_any ("/bin/bash", "/bin/sh") or tolower(ProcessCommandLine) has_any ("/bin/bash", "/bin/sh", "bash", "sh")) | project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine contains "cpan" | where ProcessCommandLine contains "/bin/sh" or ProcessCommandLine contains "bash" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, ProcessCreationTime, ProcessId, InitiatingProcessId | order by TimeGenerated desc