Question Analysis

DeviceProcessEvents | where ProcessCommandLine contains "iptables" | where ProcessCommandLine contains "-D" or ProcessCommandLine contains "--delete" | where ProcessCommandLine contains "21" or ProcessCommandLine contains "ftp" | where ProcessCommandLine contains "-j DROP" or ProcessCommandLine contains "-j REJECT" | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents | where FileName =~ "iptables" or ProcessCommandLine has "iptables" | where ProcessCommandLine has_any ("-D", "--delete") | where ProcessCommandLine has_any ("OUTPUT", "FORWARD", "21", "ftp") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

// FTP is port 21, adjust as necessary let ftp_port = 21; let fmw = DeviceProcessEvents | where ProcessCommandLine contains "iptables" or FileName =~ "iptables" | where ProcessCommandLine contains "-D" or ProcessCommandLine contains "--delete" | where ProcessCommandLine contains "OUTPUT" and ProcessCommandLine contains "DROP" and ProcessCommandLine contains toscalar(tostring(ftp_port)) | summarize count() by DeviceName, InitiatingProcessAccountUpn, ProcessCommandLine, Timestamp; fmw | sort by Timestamp desc | take 20

let linuxDeviceIds = DeviceInfo | where OSPlatform =~ "Linux" | distinct DeviceId; let base = DeviceProcessEvents | where DeviceId in (linuxDeviceIds) // Catch invocations regardless of parent (sudo/bash/etc.) | where ProcessCommandLine has_any ("iptables","ip6tables") // Rule deletion invocations | where ProcessCommandLine has_any (" -D ", " --delete ") // Must be OUTPUT chain (outbound) | where ProcessCommandLine matches regex @"(?i)\bOUTPUT\b"; // Deletions by explicit rule spec that block FTP (tcp/21) let directDeletes = base | where ProcessCommandLine has_any (" -j DROP"," -j REJECT"," --reject-with ") // FTP control port 21 (also allow service name forms and common multiport variants) | where ProcessCommandLine has_any ("--dport 21","--dports 21","--dports 21,20","--dports 20,21","--dport ftp","--dports ftp","ftp-data,ftp","ftp,ftp-data") | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, FolderPath, FullCommand=ProcessCommandLine, DeleteMode="BySpec"; // Deletions by rule number on OUTPUT chain (content unknown from command alone) let byIndex = base | where ProcessCommandLine matches regex @"(?i)\b(?:-D|--delete)\b\s+OUTPUT\s+\d+\b" | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, FolderPath, FullCommand=ProcessCommandLine, DeleteMode="ByRuleNumber"; union directDeletes, byIndex | order by TimeGenerated desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents | extend raw_cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, tostring(AdditionalFields.CommandLine), tostring(AdditionalFields.commandLine), tostring(AdditionalFields.cmdline), tostring(AdditionalFields.Command), FileName, "") | where isnotempty(raw_cmd) // keep entries that reference iptables/ip6tables | where raw_cmd matches regex @"(?i)\b(iptables|ip6tables)\b" // and include a delete/flush style action or mention OUTPUT/FTP/ports/DROP/REJECT | where raw_cmd matches regex @"(?i)(-D|--delete|--remove|-F|--flush|--delete-chain|OUTPUT|--dport\s*\d+|\bport\s*\d+\b|\bftp\b|\bDROP\b|\bREJECT\b)" // extract full iptables command (allow sudo and full paths) and the delete fragment | extend iptables_cmd = extract(@"(?i)((?:sudo\s+)?(?:/sbin/|/usr/sbin/|/bin/|/usr/bin/)?(?:iptables|ip6tables)[^\r\n]*)", 1, raw_cmd) | extend delete_part = extract(@"(?i)((?:-D|--delete|--remove|-F|--flush|--delete-chain)[^\r\n]*)", 1, raw_cmd) | project TimeGenerated, Timestamp, DeviceName, DeviceId, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessId, ProcessId, raw_cmd, iptables_cmd, delete_part | where isnotempty(iptables_cmd) | order by TimeGenerated desc | take 500

let iptablesDelCmds = ( DeviceProcessEvents | where InitiatingProcessCommandLine contains "iptables" | where (InitiatingProcessCommandLine contains "-D" or InitiatingProcessCommandLine contains "--delete") | where ( (InitiatingProcessCommandLine contains "dport" and (InitiatingProcessCommandLine contains "21")) or InitiatingProcessCommandLine contains "--dport 21" or InitiatingProcessCommandLine contains "port 21" or InitiatingProcessCommandLine contains "ftp" ) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessId ); let iptablesDelCmds2 = ( DeviceEvents | where InitiatingProcessCommandLine contains "iptables" | where (InitiatingProcessCommandLine contains "-D" or InitiatingProcessCommandLine contains "--delete") | where ( (InitiatingProcessCommandLine contains "dport" and (InitiatingProcessCommandLine contains "21")) or InitiatingProcessCommandLine contains "--dport 21" or InitiatingProcessCommandLine contains "port 21" or InitiatingProcessCommandLine contains "ftp" ) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessId ); union iptablesDelCmds, iptablesDelCmds2 | sort by TimeGenerated desc | take 100

let TimeRange = 24h; DeviceProcessEvents | where TimeGenerated >= ago(TimeRange) | where (InitiatingProcessCommandLine contains "iptables" or ProcessCommandLine contains "iptables") | where (InitiatingProcessCommandLine contains "-D" or InitiatingProcessCommandLine contains "--delete" or ProcessCommandLine contains "-D" or ProcessCommandLine contains "--delete") | where (InitiatingProcessCommandLine contains "OUTPUT" or InitiatingProcessCommandLine contains "INPUT" or InitiatingProcessCommandLine contains "FORWARD") | where (InitiatingProcessCommandLine contains "dport 21" or InitiatingProcessCommandLine contains "--dport 21" or InitiatingProcessCommandLine contains "dport21" or InitiatingProcessCommandLine contains " --dport 21") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessCreationTime, ProcessId, InitiatingProcessId, InitiatingProcessRemoteSessionIP, InitiatingProcessRemoteSessionDeviceName | order by TimeGenerated desc | take 100

DeviceProcessEvents | where ProcessCommandLine contains "iptables" and ProcessCommandLine contains "-D" and (ProcessCommandLine contains "ftp" or ProcessCommandLine contains "21") | join kind=inner (DeviceInfo | where OSPlatform == "Linux") on DeviceId | project TimeGenerated, DeviceId, DeviceName, ProcessCommandLine | order by TimeGenerated desc | summarize arg_max(TimeGenerated, *) by DeviceId | project ProcessCommandLine

DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId | join kind=inner ( DeviceProcessEvents | where FileName =~ "iptables" or ProcessCommandLine contains "iptables" | where ProcessCommandLine contains " -D " or ProcessCommandLine contains "--delete" | where ProcessCommandLine has_any("ftp", "21") ) on DeviceId | project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "iptables" | where ProcessCommandLine has "-D" | where ProcessCommandLine has "ftp" or ProcessCommandLine has "21" | project TimeGenerated, DeviceName, ProcessCommandLine | order by TimeGenerated desc | take 50

( DeviceProcessEvents | where ProcessCommandLine contains "iptables" | where ProcessCommandLine contains "-D" | where ProcessCommandLine contains "ftp" or ProcessCommandLine contains "21" | project TimeGenerated, DeviceName, FullCommand = ProcessCommandLine ) | union ( DeviceEvents | where InitiatingProcessCommandLine contains "iptables" | where InitiatingProcessCommandLine contains "-D" | where InitiatingProcessCommandLine contains "ftp" or InitiatingProcessCommandLine contains "21" | project TimeGenerated, DeviceName, FullCommand = InitiatingProcessCommandLine ) | order by TimeGenerated desc

let linuxDevices = DeviceInfo | where OSPlatform contains "Linux" | project DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where ProcessCommandLine has "iptables" and (ProcessCommandLine has "-D" or ProcessCommandLine has "--delete") and ProcessCommandLine has "OUTPUT" and (ProcessCommandLine has "--dport 21" or ProcessCommandLine has "ftp") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine | sort by TimeGenerated desc