On a Linux endpoint, process events reveal a chain of group‐enumeration utilities executed by a single session. Which utility was used to query the system’s group database?

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine contains " getent group" or ProcessCommandLine contains " /etc/group"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine, InitiatingProcessFileName, LogonId, InitiatingProcessSessionId, CreatedProcessSessionId

DeviceProcessEvents
| where FileName in~ ("getent", "cat", "groups", "id")
| where ProcessCommandLine has_any ("group", "/etc/group")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessSessionId
| summarize UtilitiesUsed=make_set(FileName) by InitiatingProcessSessionId, DeviceName, AccountName

DeviceProcessEvents
| where FileName in ('getent', 'groups', 'id')
| where ProcessCommandLine contains 'group'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, ProcessId, InitiatingProcessId, InitiatingProcessParentId

let linuxDevices = DeviceInfo
| where OSPlatform == 'Linux'
| distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (linuxDevices)
| where ProcessCommandLine has_any ('id', 'getent', 'groups') or FileName has_any ('id', 'getent', 'groups')
| summarize count() by FileName

let linux_devices = DeviceInfo
| where OSPlatform == "Linux"
| summarize arg_max(TimeGenerated, *) by DeviceId
| project DeviceId;
let group_enum_sessions =
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where DeviceId in (linux_devices)
| extend cmd = tostring(ProcessCommandLine)
| where tolower(FileName) in ("id","groups","getent","cat","grep","awk","cut") or cmd has "/etc/group" or cmd has "getent group"
| summarize utils = make_set(tolower(FileName)), firstSeen=min(TimeGenerated), lastSeen=max(TimeGenerated) by DeviceId, DeviceName, InitiatingProcessSessionId
| where array_length(utils) >= 2;
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where DeviceId in (linux_devices)
| extend cmd = tostring(ProcessCommandLine)
| where tolower(FileName) == "getent" or cmd matches regex @"\bgetent\s+group\b"
| where cmd has "group"  // ensure it's querying the group database
| join kind=inner (group_enum_sessions) on DeviceId, InitiatingProcessSessionId
| project TimeGenerated, DeviceId, DeviceName, InitiatingProcessSessionId, UtilityUsedToQueryGroupDB = "getent", ProcessCommandLine
| order by TimeGenerated asc

let linuxDevices = DeviceInfo
| where tolower(OSPlatform) has "linux"
| distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (linuxDevices)
// look for common group-enumeration commands or reads of /etc/group
| where tolower(ProcessCommandLine) has_any ("getent", "/etc/group", "groups", "id -g", "id -G")
| extend tool = case(
    tolower(ProcessCommandLine) contains "getent", "getent",
    tolower(ProcessCommandLine) contains "cat /etc/group" or tolower(ProcessCommandLine) contains "/etc/group", "cat /etc/group",
    tolower(ProcessCommandLine) contains "groups", "groups",
    tolower(ProcessCommandLine) contains "id -g" or tolower(ProcessCommandLine) contains "id -G" or tolower(FileName) == "id", "id",
    "other")
// flag whether this event queried the system group database (getent group)
| extend queried_system_group_db = iff(tool == "getent" or tolower(ProcessCommandLine) has "getent group", true, false)
| project TimeGenerated, DeviceName, DeviceId, FileName, ProcessId, CreatedProcessSessionId, InitiatingProcessFileName, InitiatingProcessId, ProcessCommandLine, tool, queried_system_group_db
| order by TimeGenerated asc

DeviceProcessEvents
| where FileName =~ "bash" or FileName =~ "sh" or FileName has_any ("getent", "groupmems", "members", "gpasswd", "cat") or ProcessCommandLine has "/etc/group" // capture shells and known utilities
| extend SessionId = coalesce(CreatedProcessSessionId, InitiatingProcessSessionId, ProcessId, InitiatingProcessId)
| summarize FirstProcess=min(ProcessCreationTime), any_DeviceName=any(DeviceName) by SessionId, InitiatingProcessAccountName, InitiatingProcessId
| join kind=inner (
    DeviceProcessEvents
    | extend SessionId = coalesce(CreatedProcessSessionId, InitiatingProcessSessionId, ProcessId, InitiatingProcessId)
    | where FileName has_any ("getent", "groupmems", "members", "gpasswd", "cat") or ProcessCommandLine has "/etc/group" or ProcessCommandLine has "getent" or ProcessCommandLine has "group" or ProcessCommandLine has "members"
    | project TimeGenerated, DeviceName, ProcessCreationTime, ProcessId, ProcessCommandLine, FileName, FolderPath, InitiatingProcessAccountName, SessionId
) on SessionId
| where ProcessCreationTime >= FirstProcess and ProcessCreationTime <= FirstProcess + 1h
| summarize arg_min(ProcessCreationTime, *) by SessionId
| project SessionId, DeviceName, ProcessCreationTime, FileName, ProcessId, ProcessCommandLine, InitiatingProcessAccountName
| order by ProcessCreationTime asc

let LinuxDevices = DeviceInfo | where OSPlatform == 'Linux' | distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (LinuxDevices)
| where (FileName == 'groups' or ProcessCommandLine contains 'getent group')
| summarize distinct_utilities = make_set(FileName) by InitiatingProcessSessionId
| project InitiatingProcessSessionId, distinct_utilities

DeviceProcessEvents
| where FileName in~ ("getent", "cat", "id", "groups")
| where ProcessCommandLine has_any ("group", "/etc/group")
| project TimeGenerated, DeviceName, InitiatingProcessSessionId, FileName, FolderPath, ProcessCommandLine
| order by TimeGenerated asc

DeviceInfo
| where OSPlatform == "Linux"
| join kind=inner (
    DeviceProcessEvents
    | where ProcessCommandLine has_any("getent group", "/etc/group")
) on DeviceId
| project TimeGenerated, DeviceName, InitiatingProcessSessionId, FileName, ProcessCommandLine
| order by TimeGenerated desc

// 1.  Define the group-enumeration utilities we are interested in
let group_enum_utils = dynamic(["id", "groups", "getent"]);

// 2.  Pull Linux process events that reference any of those binaries
let enum_calls = DeviceProcessEvents
| where Timestamp > ago(1d)   // (Time range placeholder – will be overridden by portal picker)
| where FolderPath startswith "/"              // crude indicator we are on a Linux host
| where FileName in (group_enum_utils)
| extend SessionId = coalesce(InitiatingProcessSessionId, CreatedProcessSessionId);

// 3.  Find sessions that executed more than one of the enumeration utilities (a chain)
let chained_sessions = enum_calls
| summarize util_set = makeset(FileName) by DeviceId, DeviceName, SessionId
| where array_length(util_set) > 1
| project DeviceId, DeviceName, SessionId;

// 4.  From those sessions pick the call that queried the system’s group database – “getent”
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName == "getent" and ProcessCommandLine contains "group"
| extend SessionId = coalesce(InitiatingProcessSessionId, CreatedProcessSessionId)
| join kind=inner (chained_sessions) on SessionId
| project TimeGenerated, DeviceName, SessionId, AccountName, FileName, ProcessCommandLine
| order by TimeGenerated asc

DeviceProcessEvents
| where ProcessCommandLine contains "getent" and ProcessCommandLine contains "group"
| project TimeGenerated, DeviceName, InitiatingProcessSessionId, FileName, ProcessCommandLine, ProcessCreationTime, FolderPath

DeviceProcessEvents
| where ProcessCommandLine has "group"
| summarize ProcessChain = make_set(FileName) by InitiatingProcessSessionId
| where array_index_of(ProcessChain, "getent") >= 0
| project InitiatingProcessSessionId, ProcessChain

// The resulting output shows sessions (InitiatingProcessSessionId) where the chain of utilities includes 'getent', which is used to query the system's group database.