Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner (DeviceInfo | where OSPlatform == "Linux") on DeviceId | where FileName has_any ('auditd', 'ossec-agentd', 'splunkd', 'mdatp', 'falcon-sensor', 'elastic-agent', 'syslog-ng', 'rsyslogd', 'zabbix_agentd', 'datadog-agent') or ProcessCommandLine has_any ('auditd', 'ossec-agentd', 'splunkd', 'mdatp', 'falcon-sensor', 'elastic-agent', 'syslog-ng', 'rsyslogd', 'zabbix_agentd', 'datadog-agent') | summarize count() by FileName

DeviceProcessEvents | where FileName =~ 'ps' and (ProcessCommandLine contains 'aux' or ProcessCommandLine contains 'ejvx') | summarize AgentNames = make_set(ProcessVersionInfoProductName) by DeviceName, DeviceId | project DeviceName, DeviceId, AgentNames

DeviceProcessEvents // Filter for common agent process names in FileName or ProcessCommandLine | where FileName matches regex @"(?i)(falcon|crowdstrike|sentinelone|sentinelctl|sophos|savd|mcafee|isecespd|trend|cb|carbonblack|osquery|elastic|auditd|sysmon|qualys|defendpoint|edr|clamd|defender|detection|dome|secureworks|panda|bitdefender|eset|avast|avg|comodo|f-secure|kaspersky|malwarebytes|rapid7|fireeye|forti|fidelis|huntress|tanium|sumologic|logrhythm|zeek|suricata|sysdig|wazuh|ossec)" or ProcessCommandLine matches regex @"(?i)(falcon|crowdstrike|sentinelone|sentinelctl|sophos|savd|mcafee|isecespd|trend|cb|carbonblack|osquery|elastic|auditd|sysmon|qualys|defendpoint|edr|clamd|defender|detection|dome|secureworks|panda|bitdefender|eset|avast|avg|comodo|f-secure|kaspersky|malwarebytes|rapid7|fireeye|forti|fidelis|huntress|tanium|sumologic|logrhythm|zeek|suricata|sysdig|wazuh|ossec)" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine | summarize AgentsObserved = make_set(FileName), SampleCommands = make_set(ProcessCommandLine,10), Count=count()

DeviceProcessEvents | where ProcessCommandLine containscs "osquery" or ProcessCommandLine containscs "falco" or ProcessCommandLine containscs "sysmon" or ProcessCommandLine containscs "sysdig" or ProcessCommandLine containscs "auditd" or ProcessCommandLine containscs "tripwire" or ProcessCommandLine containscs "clamav" or ProcessCommandLine containscs "loganalyzer" or ProcessCommandLine containscs "auditbeat" or ProcessCommandLine containscs "filebeat" or ProcessCommandLine containscs "packetbeat" or ProcessCommandLine containscs "suricata" or ProcessCommandLine containscs "ossec" or ProcessCommandLine containscs "wazuh" or ProcessCommandLine containscs "zeek" or ProcessCommandLine containscs "snort" | summarize AgentsObserved = make_set(ProcessCommandLine) | project AgentsObserved

DeviceProcessEvents | join kind=inner (DeviceInfo | where OSPlatform == "Linux") on DeviceId | where ProcessCommandLine contains "agent" or ProcessCommandLine contains "security" or ProcessCommandLine contains "monitor" | summarize FirstObserved=min(ProcessCreationTime), LastObserved=max(ProcessCreationTime), Count=count() by InitiatingProcessCommandLine, InitiatingProcessAccountName, DeviceName | order by LastObserved desc

let agentsRegex = @"(splunk|ossec|wazuh|osquery|falco|auditbeat|filebeat|winlogbeat|metricbeat|packetbeat|collectd|datadog|newrelic|sensu|sumologic|sumo|crowdstrike|carbonblack|tanium|qualys|mcafee|symantec|trendmicro|opswat|sentinel|azuremonitor|azuremonitoragent|microsoft)"; union DeviceProcessEvents, DeviceEvents | where isnotempty(ProcessCommandLine) // look for common 'ps ... | grep/egrep/pgrep/awk' patterns used to enumerate processes on Linux | where tolower(ProcessCommandLine) contains "ps" and ( tolower(ProcessCommandLine) contains "grep" or tolower(ProcessCommandLine) contains "egrep" or tolower(ProcessCommandLine) contains "pgrep" or tolower(ProcessCommandLine) contains "awk" ) | extend cmd = tolower(ProcessCommandLine) | extend matchedAgent = extract(agentsRegex, 1, cmd) | where isnotempty(matchedAgent) | project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine, matchedAgent | summarize Count = count(), SampleTime = min(TimeGenerated), DeviceNames = make_set(DeviceName, 10), SampleCommands = make_set(ProcessCommandLine, 5) by Agent = matchedAgent | order by Count desc

DeviceProcessEvents | where ProcessCommandLine has_any ("ps -ef", "ps aux", "ps -Ao", "ps -e", "ps -A") // commands that indicate piping to grep/egrep/awk to filter agent names | where ProcessCommandLine has_any ("grep", "egrep", "fgrep", "awk", "sed") | extend cmd=tolower(ProcessCommandLine) | extend matchedAgent= case( cmd contains "osquery" or cmd contains "osqueryd", "osquery", cmd contains "falcon" or cmd contains "crowdstrike" or cmd contains "falcon-sensor", "crowdstrike/falcon", cmd contains "datadog" or cmd contains "datadog-agent" or cmd contains "agent/datadog", "datadog", cmd contains "splunk" or cmd contains "splunkd" or cmd contains "splunkforwarder" , "splunk", cmd contains "azure" and cmd contains "monitor" or cmd contains "azuremonitoragent" or cmd contains "ama" , "azure-monitor/ama", cmd contains "sysmon" or cmd contains "sysmon-agent", "sysmon", cmd contains "elastic" or cmd contains "elastic-agent" or cmd contains "filebeat" or cmd contains "metricbeat", "elastic", cmd contains "google" and cmd contains "fluentd" or cmd contains "google-fluentd", "google-fluentd", cmd contains "telegraf" or cmd contains "influx" or cmd contains "tealium", "telegraf", cmd contains "amagent" or cmd contains "aagent" or cmd contains "amsagent" or cmd contains "azuremonitor" , "ama/aagent", cmd contains "datadog" or cmd contains "dd-agent", "datadog", cmd contains "qualys" or cmd contains "qagent" or cmd contains "qualys-cloud-agent", "qualys", cmd contains "vmware" and cmd contains "tools" , "vmware-tools", cmd contains "tanium" or cmd contains "taniumclient" or cmd contains "tanium-agent", "tanium", cmd contains "carbonblack" or cmd contains "cb" or cmd contains "cbsys" or cmd contains "cb-agent", "carbonblack", cmd contains "mcafee" or cmd contains "epcsvc" or cmd contains "mfe" , "mcafee", cmd contains "clamav" or cmd contains "clamd" , "clamav", cmd contains "agent" , "other-agent", "unknown" ) | where matchedAgent != "unknown" | summarize Count = count(), SampleTime=min(TimeGenerated) by DeviceName, matchedAgent, InitiatingProcessAccountName | order by Count desc | project DeviceName, matchedAgent, Count, SampleTime, InitiatingProcessAccountName | take 50

DeviceProcessEvents | where isnotempty(InitiatingProcessCommandLine) or isnotempty(ProcessCommandLine) | extend cmdline = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | extend cmd_lower = tolower(cmdline) | where cmd_lower contains "ps" and cmd_lower contains "grep" | mv-expand agent = dynamic(["crowdstrike","falcon","sentinelone","carbonblack","cb","symantec","mcafee","sophos","trendmicro","defender","bitdefender","cybereason","fireeye","kaspersky","malwarebytes","eset","clamav","avast","avira"]) | where cmd_lower contains agent | summarize ObservedAgents = makeset(agent), TotalMatches = count()

let AgentCandidates = dynamic(["osqueryd","ossec-agent","falcon-sensor","crowdstrike","splunkd","zabbix_agentd","auditd","clamd","clamav","monit"]); DeviceProcessEvents | where TimeGenerated >= ago(1d) | extend CmdLine = strcat(InitiatingProcessCommandLine, " ", ProcessCommandLine) | mv-expand Candidate = AgentCandidates | extend CandidateStr = tostring(Candidate) | where CmdLine contains CandidateStr | summarize arg_max(TimeGenerated, InitiatingProcessFileName, InitiatingProcessCommandLine) by DeviceName, CandidateStr | project TimeGenerated, DeviceName, ObservedAgent = CandidateStr, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where TimeGenerated between (datetime(2023-01-01) .. now()) // Timerange will be replaced externally | join kind=inner (DeviceInfo | where OSPlatform == "Linux" | project DeviceId, DeviceName) on DeviceId | where FileName has_any ("defender", "crowdstrike", "sophos", "agent") or ProcessCommandLine has_any ("defender", "crowdstrike", "sophos", "agent") | distinct FileName, DeviceName | project DeviceName, ObservedAgent=FileName | sort by DeviceName asc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId, DeviceName; DeviceProcessEvents | where ActionType == "ProcessCreated" | where DeviceId in (LinuxDevices) | where ProcessCommandLine has_any ("ps aux", "ps -ef") | where ProcessCommandLine contains "grep" | extend ObservedAgent = extract(@"grep\s+(\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, ObservedAgent | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has_any ("osquery", "wazuh", "auditd", "sysdig", "falco", "tripwire", "clamav", "chkrootkit", "rkhunter", "snort", "suricata", "ossec") | project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "ps" and ProcessCommandLine has "grep" | extend AgentName = extract(@"grep\s+(\S+)", 1, ProcessCommandLine) | summarize Count = count() by AgentName | order by Count desc