Question Analysis

DeviceFileEvents | where InitiatingProcessCommandLine contains "touch " | project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has "touch" and (ProcessCommandLine has "-t" or ProcessCommandLine has "-d" or ProcessCommandLine has "--date") | extend TargetedFile = extract(@'touch\s+(?:-[td]|--date\s+[^ ]+)?\s*([^ ]+)', 1, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, TargetedFile, FileName, FolderPath, ProcessId | order by TimeGenerated desc

DeviceFileEvents | where ActionType has "FileTime changed" or ActionType has "File Modified" or InitiatingProcessCommandLine has "touch" or InitiatingProcessCommandLine has "date" | project DeviceName, FileName, FolderPath, Timestamp, InitiatingProcessCommandLine | sort by Timestamp desc

DeviceFileEvents | where InitiatingProcessCommandLine has_any ("touch", "timestamp_modification", "modify") | extend ModifiedTimestamp = tostring(parse_json(AdditionalFields).timestamp_changed) | project FileName, FolderPath, PreviousFileName, PreviousFolderPath, ModifiedTimestamp, InitiatingProcessCommandLine, InitiatingProcessAccountName, TimeGenerated

let touchProcesses = DeviceProcessEvents | where isnotempty(ProcessCommandLine) | where tolower(ProcessCommandLine) has "touch" or tolower(ProcessCommandLine) has "utime" or tolower(ProcessCommandLine) has "utimes" or tolower(ProcessCommandLine) has "os.utime" or tolower(ProcessCommandLine) has "utime("; let fileEvents = DeviceFileEvents | where isnotempty(FileName) | project FileTime=TimeGenerated, DeviceName, InitiatingProcessId, FolderPath=tostring(FolderPath), FileName, FilePath=strcat(tostring(coalesce(tostring(FolderPath),"")),"/",FileName), ActionType, InitiatingProcessCommandLine; touchProcesses | project ProcessTime=TimeGenerated, DeviceName, ProcessId, ProcessCommandLine | join kind=inner ( fileEvents ) on $left.DeviceName == $right.DeviceName and $left.ProcessId == $right.InitiatingProcessId | extend timeDiffSec = abs(datetime_diff('second', FileTime, ProcessTime)) | where timeDiffSec <= 120 | summarize FirstSeen=min(FileTime), LastSeen=max(FileTime), Count=count(), Devices=make_set(DeviceName), ProcessCmds=make_set(ProcessCommandLine), FileEventCmds=make_set(InitiatingProcessCommandLine), ActionTypes=make_set(ActionType) by FilePath | order by LastSeen desc | limit 100

// Detect potential Linux timestamp manipulation by correlating suspicious process command-lines with file modification/attribute events let suspicious_cmds = dynamic(["touch","-t","-d","--date","utime","futimes","futimens","os.utime","settimeofday","stime","python -c","perl -e","ruby -e","find . -exec touch","touch.py"]); // Processes that include suspicious tokens in their command line let procs = DeviceProcessEvents | where ProcessCommandLine has_any (suspicious_cmds) or InitiatingProcessCommandLine has_any (suspicious_cmds) or tostring(AdditionalFields) has_any (suspicious_cmds) | project ProcTime = TimeGenerated, DeviceId, DeviceName, ProcessId, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessFileName = FileName, ProcessCreationTime; // File events showing modification or attribute changes (also look for timestamp keys in AdditionalFields) let files = DeviceFileEvents | where ActionType has_any ("FileModified","FileCreated","FileUpdated","Modified","Change","AttributesChanged","ChangeAttributes") or tostring(AdditionalFields) has_any ("mtime","atime","ctime","timestamp","time") | project FileTime = TimeGenerated, DeviceId, FileName, FolderPath, PreviousFileName, PreviousFolderPath, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessFileName, ActionType, AdditionalFields; // Correlate: same device, same process performing the file action, and close in time (within 60 seconds) procs | join kind=inner (files) on DeviceId | where ProcessId == InitiatingProcessId | where abs(datetime_diff('second', FileTime, ProcTime)) <= 60 | extend FilePath = case(isnotempty(FolderPath), strcat(FolderPath, '/', FileName), FileName) | summarize FirstSeen = min(FileTime), LastSeen = max(FileTime), Hits = count() by FilePath, DeviceName, ActionType, ProcessCommandLine, InitiatingProcessCommandLine, ProcessId, AccountName | sort by FirstSeen desc | take 200

DeviceProcessEvents | join kind=inner DeviceInfo on DeviceId | where OSPlatform contains "Linux" | where ProcessCommandLine has "touch" and (ProcessCommandLine has "-t" or ProcessCommandLine has "-r") | project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName, DeviceId | order by Timestamp desc | limit 50

DeviceInfo | where OSPlatform == 'Linux' | join kind=inner (DeviceFileEvents) on DeviceId | where InitiatingProcessCommandLine contains 'touch' or InitiatingProcessCommandLine contains 'date -s' or InitiatingProcessCommandLine contains 'utimensat' | project DeviceName, FileName, FolderPath, InitiatingProcessCommandLine, Timestamp | summarize FilesAltered=make_set(FileName), LastTimestamp=max(Timestamp) by DeviceName, FolderPath | order by LastTimestamp desc

DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId | join kind=inner ( DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessCommandLine has "touch" | where InitiatingProcessCommandLine matches regex @"touch\s+.*(-a|-c|-m|-r|-t|--date).*" | extend ModifiedFile = extract(@"touch\s+(\S+)", 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessCommandLine, ModifiedFile ) on DeviceId | order by TimeGenerated desc

DeviceProcessEvents | where Timestamp >= ago(7d) | join kind=inner ( DeviceInfo | where Timestamp >= ago(7d) | where OSPlatform == "Linux" | distinct DeviceId ) on DeviceId | where ProcessCommandLine has "touch" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, FileName | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine contains "touch" | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has "touch" | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, FolderPath | order by TimeGenerated desc

DeviceProcessEvents | where FileName == "touch" // split the command line into tokens | extend args = split(ProcessCommandLine, " ") // calculate the index of the last element | extend idx = array_length(args) - 1 // extract the target file path (last token) | extend TargetFile = tostring(args[idx]) // select the fields of interest | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, TargetFile