Question Analysis

let targetFolder = "/tmp/victim-files"; union DeviceFileEvents, DeviceEvents, DeviceProcessEvents | extend AF = tostring(AdditionalFields), PC = tostring(ProcessCommandLine), IPC = tostring(InitiatingProcessCommandLine), FN = tostring(FileName), FP = tostring(FolderPath), AT = tolower(tostring(ActionType)) // Narrow to records that reference the target folder/path anywhere in common text fields | where FP startswith targetFolder or FN startswith strcat(targetFolder, "/") or FN contains targetFolder or AF contains targetFolder or PC contains targetFolder or IPC contains targetFolder // And that include deletion indicators in ActionType, command lines or additional fields | where AT contains "delete" or AT contains "del" or AT contains "unlink" or AT contains "remove" or AT contains "rm" or tolower(AF) contains "unlink" or tolower(AF) contains "rm" or tolower(AF) contains "remove" or tolower(AF) contains "deleted" or tolower(AF) contains "delete" or tolower(PC) contains "unlink" or tolower(PC) contains "rm" or tolower(PC) contains "remove" or tolower(PC) contains "deleted" or tolower(PC) contains "delete" or tolower(IPC) contains "unlink" or tolower(IPC) contains "rm" or tolower(IPC) contains "remove" or tolower(IPC) contains "deleted" or tolower(IPC) contains "delete" // Normalize a FullPath for easier grouping | extend FullPath = case( FN contains "/", FN, isnull(FP) or FP == "", FN, FP endswith "/", strcat(FP, FN), strcat(FP, "/", FN) ) // Return the most recent evidence per file path + device | summarize arg_max(TimeGenerated, *) by tostring(FullPath), DeviceId | project TimeGenerated, DeviceName, DeviceId, FullPath, FileName = FN, FileSize, ActionType = AT, SourceType = Type, InitiatingProcessFileName, InitiatingProcessCommandLine = IPC, ProcessCommandLine = PC, AdditionalFields = AF | order by TimeGenerated desc | take 200

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; LinuxDevices | join kind=inner ( union isfuzzy=true DeviceFileEvents, DeviceEvents, DeviceProcessEvents | where FolderPath has "/tmp/victim-files" or FileName has "/tmp/victim-files" or AdditionalFields has "/tmp/victim-files" or ProcessCommandLine has "/tmp/victim-files" | where ActionType in ("FileDeleted", "FileRemove", "FileRemoved", "FileRenamed") or AdditionalFields has_any ("delete", "removed", "unlink") or (ProcessCommandLine has_any ("rm", "unlink")) | project TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, ActionType, AdditionalFields, ProcessCommandLine ) on DeviceId | project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, AdditionalFields, ProcessCommandLine | order by TimeGenerated desc

union DeviceFileEvents, DeviceProcessEvents, DeviceEvents | join kind=inner ( DeviceInfo | where OSPlatform =~ "Linux" ) on DeviceId | where FolderPath startswith "/tmp/victim-files" or AdditionalFields contains "/tmp/victim-files" or InitiatingProcessCommandLine contains "/tmp/victim-files" | where ActionType in ("FileDeleted", "FileRemoved", "FileDelete") or AdditionalFields has_any ("delete", "removed") or InitiatingProcessCommandLine has "rm " | project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, AdditionalFields, InitiatingProcessCommandLine | order by TimeGenerated desc