Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | join DeviceInfo on DeviceId | where OSPlatform == "Linux" | where ProcessCommandLine has "tor" or FileName has "tor" | project DeviceName, FileName, ProcessCommandLine, Timestamp

DeviceProcessEvents | where FileName in~ ('tor', 'tor.real', 'tor.service') or ProcessCommandLine has_any ('tor', 'tor.real', 'systemctl start tor', 'service tor start') | project TimeGenerated, DeviceName, FileName, ProcessCommandLine | summarize ExampleCommandLine = any(ProcessCommandLine), Count = count() by ServiceName = FileName | order by Count desc

DeviceProcessEvents | where ProcessCommandLine has "systemctl start tor" | extend TorService = extract(@"(\S+)$", 0, ProcessCommandLine) | distinct TorService

DeviceProcessEvents | join kind=inner DeviceInfo on DeviceId | where OSPlatform == 'Linux' | where ProcessCommandLine has 'tor' or FileName has 'tor' | project DeviceName, FileName, ProcessCommandLine, Timestamp | order by Timestamp desc | limit 10

DeviceProcessEvents | join kind=inner (DeviceInfo | where OSPlatform == 'Linux' | project DeviceId, DeviceName) on DeviceId | where ProcessCommandLine has 'start' and ProcessCommandLine has 'tor' | extend ServiceName = extract(@'start\s+(\S+)', 1, tolower(ProcessCommandLine)) | summarize DistinctServiceName = make_set(ServiceName) | project DistinctServiceName

DeviceProcessEvents | where ActionType == "ProcessCreated" | join (DeviceInfo | where OSPlatform =~ "Linux") on DeviceId | where FileName has "tor" or ProcessCommandLine has "tor" | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine

DeviceInfo | where OSPlatform =~ "Linux" | distinct DeviceId | join kind=inner ( DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has_any ("systemctl", "service") | where ProcessCommandLine has "start" | where ProcessCommandLine has "tor" // Use regex to parse out the service name that follows 'systemctl start' or 'service start' | parse kind=regex flags="i" ProcessCommandLine with "(?:systemctl|service)\\s+start\\s+([^\\s]+)" ServiceName | project DeviceId, DeviceName, TimeGenerated, ProcessCommandLine, ServiceName ) on DeviceId | order by TimeGenerated desc | take 100

DeviceProcessEvents | where InitiatingProcessCommandLine has "systemctl" and InitiatingProcessCommandLine has "start" and InitiatingProcessCommandLine has "tor" | extend launched_service = extract(@"systemctl\s+start\s+(\S+)", 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, launched_service, InitiatingProcessCommandLine

let LinuxDevices = DeviceInfo | where OSPlatform has "Linux" | project DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where InitiatingProcessCommandLine has "tor" and InitiatingProcessCommandLine has "start" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId | order by TimeGenerated desc

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | project DeviceId; linuxDevices | join kind=inner DeviceProcessEvents on DeviceId | where ProcessCommandLine has "systemctl" and ProcessCommandLine has "start" | extend ServiceName = extract(@"start\s+(\S+)", 1, ProcessCommandLine) | where ServiceName has "tor" | distinct ServiceName