Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessFileName in~ ("bash", "sh") | where ProcessCommandLine contains " cp " | where ProcessCommandLine contains "/var/spool/mail" | extend destination_path = extract(@'.* cp .* /var/spool/mail.*?\s+([^\s&;>]+)(\s*|&|;|>).*', 1, ProcessCommandLine) | where isnotempty(destination_path) | extend dest_components = split(destination_path, '/') | extend subdir_name = tostring(dest_components[array_length(dest_components) - 1]) | where isnotempty(subdir_name) | distinct subdir_name | project SubdirectoryName = subdir_name

let linux = DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId, DeviceName; let mkdirs = DeviceProcessEvents | where DeviceId in (linux | project DeviceId) | where FileName =~ "mkdir" or ProcessCommandLine has "mkdir" | project DeviceId, DeviceName, MkTime=TimeGenerated, MkCmd=ProcessCommandLine | extend Paths = extract_all("(/[^\\s'\";|&>]+)", MkCmd) | extend n = array_length(Paths) | where n > 0 | extend CreatedDirPath = tostring(Paths[n-1]) | extend CreatedDirPath = replace_regex(CreatedDirPath, "/+$", "") | extend SubdirectoryName = extract("([^/]+)$", 1, CreatedDirPath) | project DeviceId, DeviceName, MkTime, CreatedDirPath, SubdirectoryName, MkCmd; let copies = DeviceProcessEvents | where DeviceId in (linux | project DeviceId) | where FileName =~ "cp" or ProcessCommandLine has " cp " | where InitiatingProcessFileName =~ "bash" or InitiatingProcessCommandLine has "bash" | where ProcessCommandLine has "/var/spool/mail" | project DeviceId, CpTime=TimeGenerated, CpCmd=ProcessCommandLine | extend Paths = extract_all("(/[^\\s'\";|&>]+)", CpCmd) | extend n = array_length(Paths) | where n > 1 | extend DestPath = tostring(Paths[n-1]) | extend DestPath = replace_regex(DestPath, "/+$", "") | extend SrcFirst = tostring(Paths[0]) | where SrcFirst startswith "/var/spool/mail" | project DeviceId, CpTime, DestPath, CpCmd; mkdirs | join kind=innerunique copies on DeviceId | where CpTime between (MkTime .. MkTime + 6h) | where DestPath == CreatedDirPath or DestPath startswith strcat(CreatedDirPath, "/") | summarize FirstCopyTime=min(CpTime), MkTime=min(MkTime), ExampleMk=any(MkCmd), ExampleCp=any(CpCmd) by DeviceId, DeviceName, CreatedDirPath, SubdirectoryName | order by FirstCopyTime asc | project DeviceName, SubdirectoryName, CreatedDirPath, MkTime, FirstCopyTime, ExampleMk, ExampleCp

DeviceProcessEvents | where InitiatingProcessFileName =~ 'bash' | where ProcessCommandLine contains 'cp' and ProcessCommandLine contains '/var/spool/mail' | extend SubDir = extract(@'cp\s+/var/spool/mail/[^\s]+\s+([^\s]+)', 1, ProcessCommandLine) // Extracts the destination subdirectory from the command line | project Timestamp, DeviceName, ProcessCommandLine, SubDir | summarize arg_max(Timestamp, *) by SubDir // Summarizes to get the latest event per unique subdirectory

DeviceProcessEvents | where InitiatingProcessFileName == "bash" | where ProcessCommandLine has "cp" and ProcessCommandLine has "/var/spool/mail" | extend dest_directory = extract(@"/var/spool/mail/([^/\s]+)", 1, ProcessCommandLine) | where isnotempty(dest_directory) | summarize count() by dest_directory | project dest_directory

DeviceProcessEvents | where InitiatingProcessFileName =~ "bash" | where InitiatingProcessCommandLine has "cp" and InitiatingProcessCommandLine has "/var/spool/mail" | extend destFolder = extract("cp\\s+(?:-r\\s+)?/var/spool/mail\\s+(/var/spool/mail/\\S+)", 1, InitiatingProcessCommandLine) | extend subdirectory = replace("/var/spool/mail/", "", destFolder) | project TimeGenerated, InitiatingProcessCommandLine, destFolder, subdirectory | limit 100

DeviceProcessEvents | where InitiatingProcessFileName == "bash" | where ProcessCommandLine has "cp" | where ProcessCommandLine has "/var/spool/mail" | extend args = split(ProcessCommandLine, " ") // The last element in args should be the destination path | extend destPath = tostring(args[array_length(args) - 1]) | where destPath != "/var/spool/mail" | extend subdirectory = extract(@"([^/]+)$", 1, destPath) | summarize occurrences = count() by subdirectory | sort by occurrences desc