Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner (DeviceInfo | where OSPlatform == "Linux") on DeviceId | where FileName has_any ('auditd', 'ossec-agentd', 'splunkd', 'mdatp', 'falcon-sensor', 'elastic-agent', 'syslog-ng', 'rsyslogd', 'zabbix_agentd', 'datadog-agent') or ProcessCommandLine has_any ('auditd', 'ossec-agentd', 'splunkd', 'mdatp', 'falcon-sensor', 'elastic-agent', 'syslog-ng', 'rsyslogd', 'zabbix_agentd', 'datadog-agent') | summarize count() by FileName

DeviceProcessEvents | where FileName =~ 'ps' and (ProcessCommandLine contains 'aux' or ProcessCommandLine contains 'ejvx') | summarize AgentNames = make_set(ProcessVersionInfoProductName) by DeviceName, DeviceId | project DeviceName, DeviceId, AgentNames

DeviceProcessEvents // Filter for common agent process names in FileName or ProcessCommandLine | where FileName matches regex @"(?i)(falcon|crowdstrike|sentinelone|sentinelctl|sophos|savd|mcafee|isecespd|trend|cb|carbonblack|osquery|elastic|auditd|sysmon|qualys|defendpoint|edr|clamd|defender|detection|dome|secureworks|panda|bitdefender|eset|avast|avg|comodo|f-secure|kaspersky|malwarebytes|rapid7|fireeye|forti|fidelis|huntress|tanium|sumologic|logrhythm|zeek|suricata|sysdig|wazuh|ossec)" or ProcessCommandLine matches regex @"(?i)(falcon|crowdstrike|sentinelone|sentinelctl|sophos|savd|mcafee|isecespd|trend|cb|carbonblack|osquery|elastic|auditd|sysmon|qualys|defendpoint|edr|clamd|defender|detection|dome|secureworks|panda|bitdefender|eset|avast|avg|comodo|f-secure|kaspersky|malwarebytes|rapid7|fireeye|forti|fidelis|huntress|tanium|sumologic|logrhythm|zeek|suricata|sysdig|wazuh|ossec)" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine | summarize AgentsObserved = make_set(FileName), SampleCommands = make_set(ProcessCommandLine,10), Count=count()

DeviceProcessEvents | where ProcessCommandLine containscs "osquery" or ProcessCommandLine containscs "falco" or ProcessCommandLine containscs "sysmon" or ProcessCommandLine containscs "sysdig" or ProcessCommandLine containscs "auditd" or ProcessCommandLine containscs "tripwire" or ProcessCommandLine containscs "clamav" or ProcessCommandLine containscs "loganalyzer" or ProcessCommandLine containscs "auditbeat" or ProcessCommandLine containscs "filebeat" or ProcessCommandLine containscs "packetbeat" or ProcessCommandLine containscs "suricata" or ProcessCommandLine containscs "ossec" or ProcessCommandLine containscs "wazuh" or ProcessCommandLine containscs "zeek" or ProcessCommandLine containscs "snort" | summarize AgentsObserved = make_set(ProcessCommandLine) | project AgentsObserved

DeviceProcessEvents | join kind=inner (DeviceInfo | where OSPlatform == "Linux") on DeviceId | where ProcessCommandLine contains "agent" or ProcessCommandLine contains "security" or ProcessCommandLine contains "monitor" | summarize FirstObserved=min(ProcessCreationTime), LastObserved=max(ProcessCreationTime), Count=count() by InitiatingProcessCommandLine, InitiatingProcessAccountName, DeviceName | order by LastObserved desc

DeviceProcessEvents | where TimeGenerated between (datetime(2023-01-01) .. now()) // Timerange will be replaced externally | join kind=inner (DeviceInfo | where OSPlatform == "Linux" | project DeviceId, DeviceName) on DeviceId | where FileName has_any ("defender", "crowdstrike", "sophos", "agent") or ProcessCommandLine has_any ("defender", "crowdstrike", "sophos", "agent") | distinct FileName, DeviceName | project DeviceName, ObservedAgent=FileName | sort by DeviceName asc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId, DeviceName; DeviceProcessEvents | where ActionType == "ProcessCreated" | where DeviceId in (LinuxDevices) | where ProcessCommandLine has_any ("ps aux", "ps -ef") | where ProcessCommandLine contains "grep" | extend ObservedAgent = extract(@"grep\s+(\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, ObservedAgent | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has_any ("osquery", "wazuh", "auditd", "sysdig", "falco", "tripwire", "clamav", "chkrootkit", "rkhunter", "snort", "suricata", "ossec") | project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "ps" and ProcessCommandLine has "grep" | extend AgentName = extract(@"grep\s+(\S+)", 1, ProcessCommandLine) | summarize Count = count() by AgentName | order by Count desc