Question Analysis

DeviceProcessEvents | where ProcessCommandLine has "locale" or ProcessCommandLine has "localectl" | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has 'locale' or ProcessCommandLine has 'localectl' | project DeviceId, DeviceName, ProcessCommandLine, ProcessCreationTime, FileName, FolderPath | distinct DeviceName, ProcessCommandLine, ProcessCreationTime, FileName, FolderPath

DeviceProcessEvents | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | project DeviceId ) on DeviceId | where FileName in ("locale", "localectl") or ProcessCommandLine has_any ("locale", "localectl", "/etc/locale.conf", "/etc/default/locale", "LANG=") | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine | order by TimeGenerated desc | take 100

DeviceProcessEvents | where InitiatingProcessCommandLine contains "locale" or ProcessCommandLine contains "locale" | extend AccountCustomEntity = InitiatingProcessAccountUpn, HostCustomEntity = DeviceName, FileCustomEntity = InitiatingProcessCommandLine | project-away InitiatingProcessLogonId,InitiatingProcessParentId,InitiatingProcessSessionId

DeviceProcessEvents | where DeviceName contains "linux" or SourceSystem == "Linux" or InitiatingProcessFileName endswith ".sh" or InitiatingProcessFileName contains "bash" or ProcessCommandLine contains "locale" or ProcessCommandLine contains "localectl" or ProcessCommandLine contains "language" | where ProcessCommandLine contains "locale" or ProcessCommandLine contains "localectl" or ProcessCommandLine contains "language" or InitiatingProcessCommandLine contains "locale" or InitiatingProcessCommandLine contains "localectl" or InitiatingProcessCommandLine contains "language" | project DeviceName, ProcessCommandLine, FileName | distinct DeviceName, ProcessCommandLine, FileName | extend ToolUsed = FileName | project DeviceName, ToolUsed, ProcessCommandLine | sort by DeviceName asc

DeviceProcessEvents | where ProcessCommandLine contains "locale" or InitiatingProcessCommandLine contains "locale" | project DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, ProcessCommandLine, TimeGenerated

let linux_devices = DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId, DeviceName; DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner linux_devices on DeviceId | where FileName in~ ("localectl", "locale") or ProcessCommandLine has_any ("localectl", "locale") | extend Tool = iif(ProcessCommandLine has "localectl", "localectl", iif(ProcessCommandLine has "locale", "locale", tostring(FileName))) | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), EventCount=count(), Devices=dcount(DeviceId), SampleCommandLine=any(ProcessCommandLine) by Tool | order by EventCount desc

// Find Linux processes/commands that report or configure system locale settings // Adjust the keyword list if you want to broaden or narrow matches let locale_terms = dynamic(["localectl","locale-gen","localedef","update-locale","dpkg-reconfigure","locale"]); union DeviceProcessEvents, DeviceEvents | where isnotempty(FileName) or isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | extend cmd = tostring(ProcessCommandLine), fname = tostring(FileName), ipcmd = tostring(InitiatingProcessCommandLine) // Quick filter to limit rows to those containing any of the locale terms | where cmd has_any (locale_terms) or fname has_any (locale_terms) or ipcmd has_any (locale_terms) // Extract the exact matched term from combined fields | extend combined = strcat(" ", cmd, " ", fname, " ", ipcmd) | extend tool = extract(@"\b(localectl|locale\-gen|localedef|update\-locale|dpkg\-reconfigure|locale)\b", 1, combined) | where isnotempty(tool) | project TimeGenerated, DeviceName, DeviceId, ProcessId, InitiatingProcessId, FileName=fname, ProcessCommandLine=cmd, InitiatingProcessCommandLine=ipcmd, tool | summarize occurrences = count(), firstSeen = min(TimeGenerated), lastSeen = max(TimeGenerated) by tool, DeviceName, DeviceId | order by occurrences desc, lastSeen desc | limit 100

let linuxDevices = DeviceInfo | where tolower(OSPlatform) has "linux" | distinct DeviceId; union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents | where DeviceId in (linuxDevices) | extend combined = strcat( tostring(ProcessCommandLine), " ", tostring(InitiatingProcessCommandLine), " ", tostring(FileName), " ", tostring(FolderPath), " ", tostring(FileOriginUrl), " ", tostring(RegistryValueData) ) | where tolower(combined) matches regex @"\b(localectl|update-locale|printenv\s*lang|lang=|locale)\b" | extend tool = extract(@"(localectl|update-locale|printenv\s*lang|lang=|locale)", 1, tolower(combined)) | project TimeGenerated, DeviceName, DeviceId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId, AccountName, SourceSystem, tool | sort by TimeGenerated desc | take 50 // Summary of detected tool(s) | union ( union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents | where DeviceId in (linuxDevices) | extend combined = strcat( tostring(ProcessCommandLine), " ", tostring(InitiatingProcessCommandLine), " ", tostring(FileName), " ", tostring(FolderPath), " ", tostring(FileOriginUrl), " ", tostring(RegistryValueData) ) | where tolower(combined) matches regex @"\b(localectl|update-locale|printenv\s*lang|lang=|locale)\b" | extend tool = extract(@"(localectl|update-locale|printenv\s*lang|lang=|locale)", 1, tolower(combined)) | summarize event_count = count() by tool | order by event_count desc )

// Find processes that report/configure locale on Linux devices // Note: do not hardcode a time filter here — the caller will set the time range let linuxDeviceIds = DeviceInfo | where tostring(OSPlatform) has "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDeviceIds) // Look for known tool names or patterns indicating locale usage | where ( tolower(FileName) in ("locale","localectl","localed","hostnamectl") or tolower(ProcessCommandLine) has_any ("locale","localectl","localed","hostnamectl","lang=","lc_") ) | extend ToolRaw = iff(isnotempty(FileName), FileName, tostring(split(trim(" ", ProcessCommandLine), " ")[0])) | extend Tool = tolower(extract(@"([^/\\]+)$", 1, ToolRaw)) | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), SampleCmdlines=make_set(ProcessCommandLine, 5) by DeviceId, DeviceName, Tool | order by LastSeen desc | take 100 | project LastSeen, FirstSeen, Count, DeviceName, DeviceId, Tool, SampleCmdlines

let linux_devices = DeviceInfo | where OSPlatform contains 'Linux' | project DeviceId; DeviceProcessEvents | where InitiatingProcessFileName in ('locale','localectl') or InitiatingProcessCommandLine has_any ('locale','localectl') | join kind=inner (linux_devices) on DeviceId | project TimeGenerated, DeviceName, ToolUsed = InitiatingProcessFileName, CommandLine = InitiatingProcessCommandLine, ProcessId = InitiatingProcessId

let LinuxDevices = DeviceInfo | where OSPlatform contains "Linux"; let LocaleProcs = DeviceProcessEvents | where InitiatingProcessFileName in ("locale","localectl") or InitiatingProcessCommandLine contains "locale" or InitiatingProcessCommandLine contains "localectl" | project TimeGenerated, DeviceName, DeviceId, ProcessId = InitiatingProcessId, ProcessFileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFolderPath | extend ToolUsed = iif(tolower(ProcessFileName) in ("locale","localectl"), ProcessFileName, iif(ProcessCommandLine contains "locale" or ProcessCommandLine contains "localectl", "locale", "Unknown")) | distinct TimeGenerated, DeviceName, DeviceId, ProcessId, ProcessFileName, ProcessCommandLine, ToolUsed; LocaleProcs | join kind=inner (LinuxDevices) on DeviceId | project TimeGenerated, DeviceName, DeviceId, ProcessId, ProcessFileName, ProcessCommandLine, ToolUsed | sort by TimeGenerated desc

DeviceProcessEvents | join kind=inner DeviceInfo on DeviceId | where OSPlatform == 'Linux' | where ProcessCommandLine has 'locale' or InitiatingProcessFileName has 'locale' or ProcessCommandLine has 'localectl' | project DeviceName, InitiatingProcessFileName, ProcessCommandLine, Timestamp | order by Timestamp desc

DeviceInfo | where OSPlatform contains "Linux" | project DeviceId, DeviceName | join kind=inner ( DeviceProcessEvents | where ProcessCommandLine contains "locale" | project DeviceId, ProcessCommandLine, FileName, TimeGenerated ) on DeviceId | project DeviceName, ProcessCommandLine, FileName, TimeGenerated | order by TimeGenerated desc | summarize arg_max(TimeGenerated, *) by DeviceName, FileName

DeviceProcessEvents | where DeviceId in (DeviceInfo | where OSPlatform =~ "Linux" | distinct DeviceId) | where ProcessCommandLine has_any("locale", "localectl") or FileName in~ ("locale", "localectl") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceInfo | where OSPlatform =~ "Linux" | join kind=inner ( DeviceProcessEvents | where ProcessCommandLine has_any ("locale", "localectl") ) on DeviceId | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath

// --- Linux hosts only -------------------------------------------------- let linux_devices = DeviceInfo | where OSPlatform =~ "Linux" | distinct DeviceId; // --- Processes that report locale settings ----------------------------- DeviceProcessEvents | where DeviceId in (linux_devices) // match either the binary name or its appearance in the full command line | where FileName in~ ("localectl", "locale") or ProcessCommandLine has "localectl" or ProcessCommandLine has " locale " // avoid matching LANG=, LC_*, etc. | extend ToolUsed = case( FileName =~ "localectl" or ProcessCommandLine has "localectl", "localectl", FileName =~ "locale" or ProcessCommandLine has " locale ", "locale", "unknown") | project TimeGenerated, DeviceName, DeviceId, ToolUsed, ProcessCommandLine, FolderPath, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where tolower(InitiatingProcessCommandLine) contains "locale" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine | distinct DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has "locale" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine | summarize EventCount = count() by FileName, ProcessCommandLine | sort by EventCount desc

DeviceProcessEvents | where ProcessCommandLine has "locale" | join kind=inner ( DeviceInfo | where OSPlatform has "Linux" | project DeviceId ) on DeviceId | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine

// Search for executions of the 'locale' tool on Linux devices let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where FileName == "locale" or ProcessCommandLine startswith "locale" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc