An attacker on Linux used bash to copy all files from /var/spool/mail into a newly created subdirectory before modifying them. What is the name of that subdirectory?

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where InitiatingProcessFileName in~ ("bash", "sh")
| where ProcessCommandLine contains " cp "
| where ProcessCommandLine contains "/var/spool/mail"
| extend destination_path = extract(@'.* cp .* /var/spool/mail.*?\s+([^\s&;>]+)(\s*|&|;|>).*', 1, ProcessCommandLine)
| where isnotempty(destination_path)
| extend dest_components = split(destination_path, '/')
| extend subdir_name = tostring(dest_components[array_length(dest_components) - 1])
| where isnotempty(subdir_name)
| distinct subdir_name
| project SubdirectoryName = subdir_name

let linux = DeviceInfo
| where OSPlatform =~ "Linux"
| project DeviceId, DeviceName;
let mkdirs = DeviceProcessEvents
| where DeviceId in (linux | project DeviceId)
| where FileName =~ "mkdir" or ProcessCommandLine has "mkdir"
| project DeviceId, DeviceName, MkTime=TimeGenerated, MkCmd=ProcessCommandLine
| extend Paths = extract_all("(/[^\\s'\";|&>]+)", MkCmd)
| extend n = array_length(Paths)
| where n > 0
| extend CreatedDirPath = tostring(Paths[n-1])
| extend CreatedDirPath = replace_regex(CreatedDirPath, "/+$", "")
| extend SubdirectoryName = extract("([^/]+)$", 1, CreatedDirPath)
| project DeviceId, DeviceName, MkTime, CreatedDirPath, SubdirectoryName, MkCmd;
let copies = DeviceProcessEvents
| where DeviceId in (linux | project DeviceId)
| where FileName =~ "cp" or ProcessCommandLine has " cp "
| where InitiatingProcessFileName =~ "bash" or InitiatingProcessCommandLine has "bash"
| where ProcessCommandLine has "/var/spool/mail"
| project DeviceId, CpTime=TimeGenerated, CpCmd=ProcessCommandLine
| extend Paths = extract_all("(/[^\\s'\";|&>]+)", CpCmd)
| extend n = array_length(Paths)
| where n > 1
| extend DestPath = tostring(Paths[n-1])
| extend DestPath = replace_regex(DestPath, "/+$", "")
| extend SrcFirst = tostring(Paths[0])
| where SrcFirst startswith "/var/spool/mail"
| project DeviceId, CpTime, DestPath, CpCmd;
mkdirs
| join kind=innerunique copies on DeviceId
| where CpTime between (MkTime .. MkTime + 6h)
| where DestPath == CreatedDirPath or DestPath startswith strcat(CreatedDirPath, "/")
| summarize FirstCopyTime=min(CpTime), MkTime=min(MkTime), ExampleMk=any(MkCmd), ExampleCp=any(CpCmd) by DeviceId, DeviceName, CreatedDirPath, SubdirectoryName
| order by FirstCopyTime asc
| project DeviceName, SubdirectoryName, CreatedDirPath, MkTime, FirstCopyTime, ExampleMk, ExampleCp

DeviceProcessEvents
| where InitiatingProcessFileName =~ 'bash'
| where ProcessCommandLine contains 'cp' and ProcessCommandLine contains '/var/spool/mail'
| extend SubDir = extract(@'cp\s+/var/spool/mail/[^\s]+\s+([^\s]+)', 1, ProcessCommandLine)  // Extracts the destination subdirectory from the command line
| project Timestamp, DeviceName, ProcessCommandLine, SubDir
| summarize arg_max(Timestamp, *) by SubDir  // Summarizes to get the latest event per unique subdirectory

DeviceProcessEvents
| where InitiatingProcessFileName == "bash"
| where ProcessCommandLine has "cp" and ProcessCommandLine has "/var/spool/mail"
| extend dest_directory = extract(@"/var/spool/mail/([^/\s]+)", 1, ProcessCommandLine)
| where isnotempty(dest_directory)
| summarize count() by dest_directory
| project dest_directory

DeviceProcessEvents
| where InitiatingProcessFileName =~ "bash"
| where InitiatingProcessCommandLine has "cp" and InitiatingProcessCommandLine has "/var/spool/mail"
| extend destFolder = extract("cp\\s+(?:-r\\s+)?/var/spool/mail\\s+(/var/spool/mail/\\S+)", 1, InitiatingProcessCommandLine)
| extend subdirectory = replace("/var/spool/mail/", "", destFolder)
| project TimeGenerated, InitiatingProcessCommandLine, destFolder, subdirectory
| limit 100

DeviceProcessEvents
| where InitiatingProcessFileName == "bash"
| where ProcessCommandLine has "cp"
| where ProcessCommandLine has "/var/spool/mail"
| extend args = split(ProcessCommandLine, " ")
// The last element in args should be the destination path
| extend destPath = tostring(args[array_length(args) - 1])
| where destPath != "/var/spool/mail"
| extend subdirectory = extract(@"([^/]+)$", 1, destPath)
| summarize occurrences = count() by subdirectory
| sort by occurrences desc