Investigate Linux process execution logs for any use of iptables that removes a rule blocking outbound FTP traffic. What full command was issued to delete this rule?

DeviceProcessEvents
| where ProcessCommandLine contains "iptables"
| where ProcessCommandLine contains "-D" or ProcessCommandLine contains "--delete"
| where ProcessCommandLine contains "21" or ProcessCommandLine contains "ftp"
| where ProcessCommandLine contains "-j DROP" or ProcessCommandLine contains "-j REJECT"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents
| where FileName =~ "iptables" or ProcessCommandLine has "iptables"
| where ProcessCommandLine has_any ("-D", "--delete")
| where ProcessCommandLine has_any ("OUTPUT", "FORWARD", "21", "ftp")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

// FTP is port 21, adjust as necessary
let ftp_port = 21;
let fmw = DeviceProcessEvents
| where ProcessCommandLine contains "iptables" or FileName =~ "iptables"
| where ProcessCommandLine contains "-D" or ProcessCommandLine contains "--delete"
| where ProcessCommandLine contains "OUTPUT" and ProcessCommandLine contains "DROP" and ProcessCommandLine contains toscalar(tostring(ftp_port))
| summarize count() by DeviceName, InitiatingProcessAccountUpn, ProcessCommandLine, Timestamp;
fmw
| sort by Timestamp desc
| take 20

let linuxDeviceIds = DeviceInfo
| where OSPlatform =~ "Linux"
| distinct DeviceId;
let base = DeviceProcessEvents
| where DeviceId in (linuxDeviceIds)
// Catch invocations regardless of parent (sudo/bash/etc.)
| where ProcessCommandLine has_any ("iptables","ip6tables")
// Rule deletion invocations
| where ProcessCommandLine has_any (" -D ", " --delete ")
// Must be OUTPUT chain (outbound)
| where ProcessCommandLine matches regex @"(?i)\bOUTPUT\b";
// Deletions by explicit rule spec that block FTP (tcp/21)
let directDeletes = base
| where ProcessCommandLine has_any (" -j DROP"," -j REJECT"," --reject-with ")
// FTP control port 21 (also allow service name forms and common multiport variants)
| where ProcessCommandLine has_any ("--dport 21","--dports 21","--dports 21,20","--dports 20,21","--dport ftp","--dports ftp","ftp-data,ftp","ftp,ftp-data")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, FolderPath, FullCommand=ProcessCommandLine, DeleteMode="BySpec";
// Deletions by rule number on OUTPUT chain (content unknown from command alone)
let byIndex = base
| where ProcessCommandLine matches regex @"(?i)\b(?:-D|--delete)\b\s+OUTPUT\s+\d+\b"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, FolderPath, FullCommand=ProcessCommandLine, DeleteMode="ByRuleNumber";
union directDeletes, byIndex
| order by TimeGenerated desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents
| extend raw_cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, tostring(AdditionalFields.CommandLine), tostring(AdditionalFields.commandLine), tostring(AdditionalFields.cmdline), tostring(AdditionalFields.Command), FileName, "")
| where isnotempty(raw_cmd)
// keep entries that reference iptables/ip6tables
| where raw_cmd matches regex @"(?i)\b(iptables|ip6tables)\b"
// and include a delete/flush style action or mention OUTPUT/FTP/ports/DROP/REJECT
| where raw_cmd matches regex @"(?i)(-D|--delete|--remove|-F|--flush|--delete-chain|OUTPUT|--dport\s*\d+|\bport\s*\d+\b|\bftp\b|\bDROP\b|\bREJECT\b)"
// extract full iptables command (allow sudo and full paths) and the delete fragment
| extend iptables_cmd = extract(@"(?i)((?:sudo\s+)?(?:/sbin/|/usr/sbin/|/bin/|/usr/bin/)?(?:iptables|ip6tables)[^\r\n]*)", 1, raw_cmd)
| extend delete_part = extract(@"(?i)((?:-D|--delete|--remove|-F|--flush|--delete-chain)[^\r\n]*)", 1, raw_cmd)
| project TimeGenerated, Timestamp, DeviceName, DeviceId, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessId, ProcessId, raw_cmd, iptables_cmd, delete_part
| where isnotempty(iptables_cmd)
| order by TimeGenerated desc
| take 500

let iptablesDelCmds = (
    DeviceProcessEvents
    | where InitiatingProcessCommandLine contains "iptables"
    | where (InitiatingProcessCommandLine contains "-D" or InitiatingProcessCommandLine contains "--delete")
    | where (
        (InitiatingProcessCommandLine contains "dport" and (InitiatingProcessCommandLine contains "21")) or
        InitiatingProcessCommandLine contains "--dport 21" or
        InitiatingProcessCommandLine contains "port 21" or
        InitiatingProcessCommandLine contains "ftp"
    )
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessId
);
let iptablesDelCmds2 = (
    DeviceEvents
    | where InitiatingProcessCommandLine contains "iptables"
    | where (InitiatingProcessCommandLine contains "-D" or InitiatingProcessCommandLine contains "--delete")
    | where (
        (InitiatingProcessCommandLine contains "dport" and (InitiatingProcessCommandLine contains "21")) or
        InitiatingProcessCommandLine contains "--dport 21" or
        InitiatingProcessCommandLine contains "port 21" or
        InitiatingProcessCommandLine contains "ftp"
    )
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessId
);
union iptablesDelCmds, iptablesDelCmds2
| sort by TimeGenerated desc
| take 100

let TimeRange = 24h;
DeviceProcessEvents
| where TimeGenerated >= ago(TimeRange)
| where (InitiatingProcessCommandLine contains "iptables" or ProcessCommandLine contains "iptables")
| where (InitiatingProcessCommandLine contains "-D" or InitiatingProcessCommandLine contains "--delete" or ProcessCommandLine contains "-D" or ProcessCommandLine contains "--delete")
| where (InitiatingProcessCommandLine contains "OUTPUT" or InitiatingProcessCommandLine contains "INPUT" or InitiatingProcessCommandLine contains "FORWARD")
| where (InitiatingProcessCommandLine contains "dport 21" or InitiatingProcessCommandLine contains "--dport 21" or InitiatingProcessCommandLine contains "dport21" or InitiatingProcessCommandLine contains " --dport 21")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessCreationTime, ProcessId, InitiatingProcessId, InitiatingProcessRemoteSessionIP, InitiatingProcessRemoteSessionDeviceName
| order by TimeGenerated desc
| take 100

DeviceProcessEvents
| where ProcessCommandLine contains "iptables" and ProcessCommandLine contains "-D" and (ProcessCommandLine contains "ftp" or ProcessCommandLine contains "21")
| join kind=inner (DeviceInfo | where OSPlatform == "Linux") on DeviceId
| project TimeGenerated, DeviceId, DeviceName, ProcessCommandLine
| order by TimeGenerated desc
| summarize arg_max(TimeGenerated, *) by DeviceId
| project ProcessCommandLine

DeviceInfo
| where OSPlatform == "Linux"
| distinct DeviceId
| join kind=inner (
    DeviceProcessEvents
    | where FileName =~ "iptables" or ProcessCommandLine contains "iptables"
    | where ProcessCommandLine contains " -D " or ProcessCommandLine contains "--delete"
    | where ProcessCommandLine has_any("ftp", "21")
) on DeviceId
| project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine has "iptables"
| where ProcessCommandLine has "-D"
| where ProcessCommandLine has "ftp" or ProcessCommandLine has "21"
| project TimeGenerated, DeviceName, ProcessCommandLine
| order by TimeGenerated desc
| take 50

(
  DeviceProcessEvents
  | where ProcessCommandLine contains "iptables"
  | where ProcessCommandLine contains "-D"
  | where ProcessCommandLine contains "ftp" or ProcessCommandLine contains "21"
  | project TimeGenerated, DeviceName, FullCommand = ProcessCommandLine
)
| union (
  DeviceEvents
  | where InitiatingProcessCommandLine contains "iptables"
  | where InitiatingProcessCommandLine contains "-D"
  | where InitiatingProcessCommandLine contains "ftp" or InitiatingProcessCommandLine contains "21"
  | project TimeGenerated, DeviceName, FullCommand = InitiatingProcessCommandLine
)
| order by TimeGenerated desc

let linuxDevices = DeviceInfo
| where OSPlatform contains "Linux"
| project DeviceId;
DeviceProcessEvents
| where DeviceId in (linuxDevices)
| where ProcessCommandLine has "iptables"
  and (ProcessCommandLine has "-D" or ProcessCommandLine has "--delete")
  and ProcessCommandLine has "OUTPUT"
  and (ProcessCommandLine has "--dport 21" or ProcessCommandLine has "ftp")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine
| sort by TimeGenerated desc