Question Analysis

DeviceProcessEvents | where FileName == "chmod" | where ProcessCommandLine has "-R" or ProcessCommandLine has "-r" // Extract the target path assuming it's the first sequence of non-space characters after the recursive flag and a space. // This regex (?:-R|-r)\s+(\S+) matches: // (?:-R|-r) - a non-capturing group for either "-R" or "-r" // \s+ - one or more whitespace characters // (\S+) - one or more non-whitespace characters (this is captured in group 1) | extend TargetedPath = extract(@"(?:-R|-r)\s+(\S+)", 1, ProcessCommandLine) | where isnotempty(TargetedPath) // Filter out events where extraction failed or didn't find a target | project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, TargetedPath, AccountName, AccountDomain

DeviceProcessEvents | where InitiatingProcessCommandLine contains 'chmod' and InitiatingProcessCommandLine contains '-R' | project Timestamp, DeviceName, InitiatingProcessCommandLine, FolderPath

DeviceProcessEvents | where FileName == "chmod" or ProcessCommandLine has "chmod" | where ProcessCommandLine has "-R" or ProcessCommandLine has "--recursive" | extend TargetPath = extract("chmod .*-R(?:[ =]?|[[:space:]]+| --recursive[ =]?)([^ ]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, AccountDomain, ProcessCommandLine, TargetPath | order by TimeGenerated desc

DeviceProcessEvents | where FileName == "chmod" and (ProcessCommandLine has "-R" or ProcessCommandLine has "--recursive") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, TargetPath = strcat(FolderPath, "/", FileName), ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == 'ProcessCreated' and FileName endswith 'chmod' | where ProcessCommandLine contains '-R' or ProcessCommandLine contains '--recursive' | extend TargetPath = extract(@'chmod\s+[\S]+\s+(\S+)', 1, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, TargetPath | where isnotempty(TargetPath) | take 10

DeviceProcessEvents | where InitiatingProcessCommandLine contains "chmod" and InitiatingProcessCommandLine contains "-R" | extend TargetFileOrFolder = extract(@"chmod\s.*\-R\s(\S+)", 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, TargetFileOrFolder, InitiatingProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has 'chmod' and (ProcessCommandLine has '-R' or ProcessCommandLine has '--recursive') | join kind=inner DeviceInfo on DeviceId | where OSPlatform contains 'Linux' | extend TargetPath = extract('chmod[^>]*[ ]+[^ ]*[ ]+([^ ]+)', 1, ProcessCommandLine) | project Timestamp, DeviceName, AccountName, ProcessCommandLine, TargetPath | order by Timestamp desc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ProcessCommandLine contains "chmod" and ProcessCommandLine contains "-R" | extend TargetPath = extract(@"chmod\s+-R\s+\\S+\\s+([^\\s]+)", 1, ProcessCommandLine) // Extracts the path after chmod -R and its arguments | project Timestamp, DeviceName, ProcessCommandLine, TargetPath | order by Timestamp desc | limit 100 // Limits results for performance; adjust as needed

DeviceProcessEvents | where DeviceId in (DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId) | where FileName == "chmod" | where ProcessCommandLine contains "-R" or ProcessCommandLine contains "--recursive" // Attempt to capture the last command line argument as the target path: | extend TargetPath = extract(@"(/\S+)$", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, FolderPath, ProcessCommandLine, TargetPath | order by TimeGenerated desc

DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId | join ( DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "chmod" | where ProcessCommandLine has_any ("-R", "--recursive") ) on DeviceId | project TimeGenerated, DeviceName, FolderPath, ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains "chmod" and ProcessCommandLine contains "-R" | extend Target = extract(@"-R\s+(?:[0-7]{3}\s+)?([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, Target

DeviceProcessEvents | where ProcessCommandLine has "chmod" and ProcessCommandLine has "-R" | extend Target = extract(@"chmod\s+-R\s+(?:[0-7]{3,4}\s+)?(\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, Target | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains "chmod" | where ProcessCommandLine matches regex @"chmod\s+(?:-[^\s]*\s+)*-R" | extend TargetPath = extract(@"chmod\s+(?:-[^\s]*\s+)*-R\s+([^\s]+)", 1, ProcessCommandLine) | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | project DeviceId ) on DeviceId | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, TargetPath

DeviceProcessEvents | where FileName == "chmod" | where ProcessCommandLine has "-R" | extend args = split(ProcessCommandLine, " ") | extend target = args[array_length(args) - 1] | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, target