Question Analysis

DeviceFileEvents | where FolderPath startswith "/var/spool/cron/crontabs" | where ActionType == "FileCreated" or ActionType == "FileWritten" | project Timestamp, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessCommandLine

DeviceFileEvents | where FolderPath startswith "/var/spool/cron/crontabs" | where ActionType in ("FileCreated", "FileCreated (CreateFile)", "FileWritten", "FileCreatedOrWritten") | project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessAccountName, InitiatingProcessFileName

DeviceFileEvents | where (ActionType =~ "FileCreated" or ActionType =~ "FileModified") | where FolderPath contains "/var/spool/cron/crontabs/" | project-reorder Timestamp, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessFileName, MD5, SHA256 | extend timestamp = Timestamp, FileNameArray = split(FolderPath, "/") | extend FileName = tostring(FileNameArray[4]) | project-rename MDTimestamp = Timestamp, MDEventTime = timestamp, MDDeviceName = DeviceName, MDFolderPath = FolderPath, MDProcessName = InitiatingProcessCommandLine, MDParentProcessName = InitiatingProcessParentFileName, MDMD5 = MD5, MDOwner = InitiatingProcessAccountName | extend NTDomain = iff(MDOwner contains "@", tostring(split(MDOwner, "@", 1)[0]), MDOwner) | extend NTDomain = iff(MDOwner contains "\\", tostring(split(MDOwner, "\\", 1)[0]), NTDomain) | extend Name = iff(MDOwner contains "@", tostring(split(MDOwner, "@", 0)[0]), MDOwner) | extend Name = iff(MDOwner contains "\\", tostring(split(MDOwner, "@", 0)[1]), Name) | project MDTimestamp, MDEventTime, MDDeviceName, FileName, MDFolderPath, MDProcessName, MDParentProcessName, MDMD5, SHA256, NTDomain ,Name | extend OSPlatform = "Linux" | distinct MDTimestamp , MDEventTime, MDDeviceName, OSPlatform, FileName, MDFolderPath, MDProcessName, MDMD5, SHA256, NTDomain, Name, MDParentProcessName | project MDTimestamp, MDEventTime, MDDeviceName, OSPlatform, FileName, MDFolderPath, MDProcessName, MDMD5, SHA256, NTDomain, Name, MDParentProcessName | extend timestamp = MDTimestamp, Name = tostring(split(Name, "@", 0)[0]) | extend Account_0_Name = Name | extend Account_0_NTDomain = NTDomain | extend Host_0_HostName = MDDeviceName | extend Host_0_OSType = OSPlatform | extend File_0_Name = FileName | extend File_0_Directory = MDFolderPath | extend Process_0_ProcessId = MDProcessName | extend FileHash_0_Algorithm = "MD5" | extend FileHash_0_Value = MDMD5 | extend FileHash_1_Algorithm = "SHA256" | extend FileHash_1_Value = SHA256 | extend Process_1_ProcessId = MDParentProcessName

DeviceFileEvents | where FolderPath startswith "/var/spool/cron/crontabs" | where ActionType in ("FileCreated", "FileWritten") | project TimeGenerated, DeviceName, FileName, ActionType, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceFileEvents | where FolderPath contains '/var/spool/cron/crontabs' and ActionType in ('FileCreated', 'FileModified') | project TimeGenerated, FileName, FolderPath, ActionType

let cron_dir = "/var/spool/cron/crontabs"; let linux_devices = DeviceInfo | where OSPlatform == "Linux" | project DeviceId; DeviceFileEvents | where DeviceId in (linux_devices) | where ActionType in ("FileCreated", "FileModified", "FileRenamed") | where FolderPath hasprefix cron_dir or (ActionType == "FileRenamed" and (FolderPath hasprefix cron_dir or coalesce(PreviousFolderPath, "") hasprefix cron_dir)) | extend Operation = case( ActionType == "FileCreated", "Created", ActionType == "FileModified", "Modified", ActionType == "FileRenamed" and not(coalesce(PreviousFolderPath, "") hasprefix cron_dir) and (FolderPath hasprefix cron_dir), "MovedIntoDir", ActionType == "FileRenamed" and (coalesce(PreviousFolderPath, "") hasprefix cron_dir) and (FolderPath hasprefix cron_dir), "RenamedWithinDir", "Other") | where Operation in ("Created", "Modified", "MovedIntoDir") | extend AddedFileName = FileName, AddedFilePath = strcat(FolderPath, "/", FileName) | project TimeGenerated, DeviceName, DeviceId, Operation, AddedFileName, AddedFilePath, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, PreviousFolderPath, PreviousFileName | order by TimeGenerated desc

union isfuzzy=true DeviceFileEvents, DeviceEvents | where ( tolower(coalesce(FolderPath, "")) startswith "/var/spool/cron/crontabs" or tolower(coalesce(FileName, "")) contains "/var/spool/cron/crontabs" or tostring(AdditionalFields) contains "/var/spool/cron/crontabs" ) | where ( tolower(coalesce(ActionType, "")) contains "creat" or tolower(coalesce(ActionType, "")) contains "write" or tolower(coalesce(ActionType, "")) contains "modif" ) | extend FolderPathLower = tolower(coalesce(FolderPath, "")), FileNameStr = tostring(FileName) // Build a full path: if FileName is already an absolute path use it, otherwise prefix FolderPath | extend FullPath = iff(FileNameStr startswith "/", FileNameStr, strcat(FolderPathLower, "/", FileNameStr)) | extend AddedFile = extract(@'([^/]+)$', 1, FullPath) | project TimeGenerated, DeviceName, AccountName, ActionType, FullPath, AddedFile, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields | summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Devices = dcount(DeviceName), DeviceList = make_set(DeviceName, 20) by AddedFile, FullPath | order by LastSeen desc | take 200

let targetPath = "/var/spool/cron/crontabs"; let actions = dynamic(["FileCreated","Created","FileCreatedByUser","CreatedFile","Write","Written","Modify","Modified","FileModified","Change","FileWritten","Created"]); let normalizeFullPath = (folderpath:string, filename:string){ // Prefer FileName when it contains full path, else combine iif(isnotempty(filename) and filename contains "/", filename, strcat(folderpath, "/", filename)) }; let srcFile = DeviceFileEvents | where isnotempty(FolderPath) or isnotempty(FileName) | where (FolderPath contains targetPath) or (FileName contains targetPath) or (isnotempty(FileName) and FileName startswith strcat(targetPath, "/")) | where ActionType in ("FileCreated","Created","FileCreatedByUser","CreatedFile","Write","Written","Modify","Modified","FileModified","Change","FileWritten","Created") | extend FullPath = normalizeFullPath(FolderPath, FileName) | extend Parts = split(FullPath, "/") | extend CrontabFile = tostring(Parts[array_length(Parts)-1]) | project TimeGenerated, DeviceName, ActionType, CrontabFile, FullPath, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, RequestAccountName, AdditionalFields; let srcDev = DeviceEvents | where isnotempty(FolderPath) or isnotempty(FileName) | where (FolderPath contains targetPath) or (FileName contains targetPath) or (isnotempty(FileName) and FileName startswith strcat(targetPath, "/")) | where ActionType in ("FileCreated","Created","CreatedFile","Write","Written","Modify","Modified","Change","FileWritten","Created") | extend FullPath = normalizeFullPath(FolderPath, FileName) | extend Parts = split(FullPath, "/") | extend CrontabFile = tostring(Parts[array_length(Parts)-1]) | project TimeGenerated, DeviceName, ActionType, CrontabFile, FullPath, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, AdditionalFields; (srcFile) | union (srcDev) | where isnotempty(CrontabFile) and CrontabFile != "" and FullPath contains targetPath | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), Devices=make_set(DeviceName), InitiatingProcesses=make_set(InitiatingProcessFileName), InitiatingCmds=make_set(InitiatingProcessCommandLine), Accounts=make_set(coalesce(InitiatingProcessAccountName, InitiatingProcessAccountDomain, RequestAccountName)) by CrontabFile, FullPath, ActionType | order by LastSeen desc | take 500

DeviceFileEvents | where ActionType in ('FileCreated', 'FileModified') | where FolderPath contains '/var/spool/cron/crontabs' | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessFileName | order by Timestamp desc

DeviceFileEvents | where FolderPath has "/var/spool/cron/crontabs" | where ActionType in~ ('FileCreated', 'FileModified') | project TimeGenerated, DeviceName, FileName, ActionType | summarize AddedFiles = make_set(FileName), LatestTime = arg_max(TimeGenerated, *) by DeviceName, ActionType | order by LatestTime desc

DeviceFileEvents | where ActionType in ("FileCreated","FileModified") | where FolderPath startswith "/var/spool/cron/crontabs" | project TimeGenerated, DeviceId, DeviceName, ActionType, FolderPath, FileName

DeviceFileEvents | where FolderPath startswith "/var/spool/cron/crontabs" and ActionType in ("FileCreated", "FileModified") | project TimeGenerated, DeviceName, ActionType, FolderPath, FileName

let cronPath = "/var/spool/cron/crontabs"; DeviceFileEvents // --- Only Linux endpoints (comment this block if not needed) ------------------- | extend DeviceIdTmp = DeviceId | join kind=inner ( DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId, OSPlatform ) on DeviceId // ----------------------------------------------------------------------------- | where FolderPath startswith cronPath | where ActionType in ("FileCreated", "FileWritten", "FileModified", "FileCreate", "FileWrite") | project TimeGenerated, DeviceName, FilePath = strcat(FolderPath, "/", FileName), ActionType, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId | order by TimeGenerated desc

union isfuzzy=true DeviceFileEvents, DeviceEvents | where FolderPath has "/var/spool/cron/crontabs" | where ActionType in ("FileCreated", "FileWrite", "FileWritten") | project TimeGenerated, FileName, ActionType, FolderPath

union withsource=TableName DeviceFileEvents, DeviceEvents, DeviceProcessEvents | where isnotempty(FolderPath) and tolower(FolderPath) contains "/var/spool/cron/crontabs" | where tolower(ActionType) contains "creat" or tolower(ActionType) contains "write" | project TimeGenerated, FileName, ActionType, FolderPath, TableName | order by TimeGenerated desc

DeviceFileEvents | where FolderPath has "/var/spool/cron/crontabs" | where ActionType in ("FileCreated", "FileWritten", "FileModified", "FileOpenedWrite") | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), EventCount = count() by FileName | sort by LastSeen desc

DeviceFileEvents | where FolderPath startswith "/var/spool/cron/crontabs" | where ActionType in ("FileCreated", "FileWrite", "FileModified") | project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessCommandLine | sort by TimeGenerated desc