Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine matches regex @".*\|\s*(bash|sh|python|pwsh)" | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId

DeviceProcessEvents | where ProcessCommandLine contains '|' | where ProcessCommandLine matches regex @"\|\s*(sh|bash|zsh|/bin/sh|/bin/bash|/bin/zsh)" | extend download_tool = case(ProcessCommandLine has "curl", "curl", ProcessCommandLine has "wget", "wget", ProcessCommandLine has "python", "python", "other") | extend script_url = extract("(https?://[^ |;]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, download_tool, script_url, InitiatingProcessCommandLine, InitiatingProcessFileName, FolderPath

let whitelisted_tools = dynamic(["at", "batch", "bc", "bash", "curl", "ftp", "ksh", "mksh", "openssl", "php", "nc", "ncat", "netcat", "paste", "perl", "ps", "python2", "python3", "rpm", "sh", "sort", "ssh", "telnet", "timeout", "vi", "watch", "zsh"]); DeviceProcessEvents | where ProcessCommandLine contains "|" and ProcessCommandLine contains "%" | extend pattern = extract(@"([a-zA-Z]+)\s*\|\s*\%*", 1, ProcessCommandLine) | where isnotnull(pattern) and pattern !in (whitelisted_tools) | summarize count() by DeviceName, SHA256, ProcessCommandLine, pattern, AccountName | sort by count_ desc | extend AccountName = tostring(split(AccountName, "@", 0)[0]) | extend UPNSuffix = tostring(split(AccountName, "@", 1)[1])

DeviceProcessEvents | where FileName in~ ('bash', 'sh', 'dash') | where ProcessCommandLine contains '| sh' or ProcessCommandLine contains '| bash' or ProcessCommandLine contains '|python' or ProcessCommandLine contains '|curl' or ProcessCommandLine contains '|wget' | extend toolUsed = case( ProcessCommandLine contains '| curl', 'curl', ProcessCommandLine contains '| wget', 'wget', ProcessCommandLine contains '| python', 'python', 'unknown') | project ProcessId, ProcessCommandLine, toolUsed, InitiatingProcessFileName, InitiatingProcessCreationTime, DeviceName

DeviceProcessEvents | where ProcessCommandLine contains '|' and ProcessCommandLine matches regex @'(sh|bash|zsh|ksh|tcsh|dash)\s' | where ProcessCommandLine contains 'curl' or ProcessCommandLine contains 'wget' or ProcessCommandLine contains 'http' | join kind=inner ( DeviceInfo | where OSPlatform == 'Linux' ) on DeviceId | project DeviceName, FileName, ProcessCommandLine, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessCommandLine | order by ProcessCreationTime desc

DeviceInfo | where OSPlatform == 'Linux' | join kind=inner (DeviceProcessEvents) on DeviceId | where ProcessCommandLine contains '|' and (ProcessCommandLine contains 'curl' or ProcessCommandLine contains 'wget') and (ProcessCommandLine contains 'bash' or ProcessCommandLine contains 'sh') | project TimeGenerated, DeviceId, DeviceName, ProcessCommandLine, InitiatingProcessFileName | summarize arg_max(TimeGenerated, *) by DeviceId, ProcessCommandLine | order by TimeGenerated desc

DeviceInfo | where OSPlatform == "Linux" | join kind=inner ( DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "|" // check for pipe in command line | where ProcessCommandLine has_any ("curl", "wget") // check for download tools | where ProcessCommandLine has_any ("bash", "sh", "zsh", "python", "perl") // check for shell execution ) on DeviceId | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath, FileName, SHA256, OSPlatform | order by TimeGenerated desc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where tolower(ProcessCommandLine) has "|" // searching for pipe | where tolower(ProcessCommandLine) has_any ("bash", "sh") // searching for piping to a shell | where tolower(ProcessCommandLine) has_any ("curl", "wget", "python", "nc") | extend ToolUsed = extract(@"(curl|wget|python|nc)", 1, tolower(ProcessCommandLine)) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ToolUsed, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | extend cmd = iif(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine) | where isnotempty(cmd) | where tolower(cmd) matches regex ".*(curl|wget).*\\|\\s*(sh|bash).*" | extend downloadTool = tolower(extract("(?i)(curl|wget)", 1, cmd)) | project TimeGenerated, DeviceName, cmd, downloadTool | sort by TimeGenerated desc

DeviceProcessEvents | where isnotempty(InitiatingProcessCommandLine) | where InitiatingProcessCommandLine has "|" and (InitiatingProcessCommandLine has "curl" or InitiatingProcessCommandLine has "wget") | extend DownloadTool = case(InitiatingProcessCommandLine contains "curl", "curl", InitiatingProcessCommandLine contains "wget", "wget", "unknown") | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, DownloadTool | sort by TimeGenerated desc

// Timerange is applied externally by the UI DeviceInfo | where OSPlatform has "Linux" | project DeviceId, OSPlatform | join kind=inner ( DeviceProcessEvents // look for a pipeline to a shell with a download tool | where ProcessCommandLine has "|" | where ProcessCommandLine matches regex @"(?i)\b(?:curl|wget|fetch|perl|python)\b.*\|\s*(?:bash|sh)\b" ) on DeviceId | extend Downloader = extract(@"(?i)\b(curl|wget|fetch|perl|python)\b", 1, ProcessCommandLine), Shell = extract(@"(?i)\|\s*(bash|sh)\b", 1, ProcessCommandLine), URL = extract(@"(?i)(?:curl|wget|fetch)\s+.*?(https?://\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, OSPlatform, AccountName = InitiatingProcessAccountName, ProcessFileName = FileName, ProcessCommandLine, Downloader, Shell, URL | sort by TimeGenerated desc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) // Note: the TimeGenerated filter is set via the external time range picker | where ProcessCommandLine matches regex "(?i)\\b(?:curl|wget|fetch)\\b.*\\|\\s*(?:bash|sh|zsh)\\b" | extend DownloaderTool = tostring(extract("(?i)\\b(curl|wget|fetch)\\b", 1, ProcessCommandLine)), ShellUsed = tostring(extract("\\|\\s*(bash|sh|zsh)\\b", 1, ProcessCommandLine)) | project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, DownloaderTool, ShellUsed, ProcessCommandLine, InitiatingProcessFileName, ProcessId | order by TimeGenerated desc