Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "dd" and ProcessCommandLine has "if=/proc/" and ProcessCommandLine has "/mem" | extend OutputFileName = extract(@"of=([^ ]+)", 1, ProcessCommandLine) | where isnotempty(OutputFileName) | project TimeGenerated, DeviceName, ProcessCommandLine, OutputFileName | order by TimeGenerated asc

DeviceProcessEvents | where ProcessCommandLine has 'dd' and ProcessCommandLine has '/proc/' and ProcessCommandLine has '/mem' | parse ProcessCommandLine with * 'of=' FileName ' ' * | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, ProcessId, FileName

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName == "dd" or ProcessCommandLine has "dd " | where ProcessCommandLine matches regex @"if=/proc/\d+/mem" | extend outputFile = extract(@"of=([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, outputFile | where isnotempty(outputFile)

DeviceProcessEvents | where FileName in~ ("dd", "dd.exe") // Look for command with the input file i.e. if=/proc/PID/mem | where ProcessCommandLine has_all ("if=/proc", "/mem") // Project the output file after the 'of=' syntax in the command | extend DumpWrittenOnHostFile = trim(@"'", tostring(extract(@"of=([\w-\.:/\\]*?) ",1,ProcessCommandLine ))) | where isnotempty(DumpWrittenOnHostFile) | summarize any(*) by DumpWrittenOnHostFile | order by tostring(DumpWrittenOnHostFile) asc | take 50 // Project only the output file name in the memory dump file | project DumpWrittenOnHostFile //, * // Uncomment to show results and files dropped by each host // | extend HostName = tostring(split(DeviceName, '.') [0]), DnsDomain = tostring(strcat_array(array_slice(split(DeviceName, '.'), 1, -1), '.'))

DeviceProcessEvents | where ProcessCommandLine has "dd" and ProcessCommandLine matches regex @"/proc/[0-9]+/mem" | extend OutputFile = extract(@"of=([^\s]+)", 1, ProcessCommandLine) | where isnotempty(OutputFile) | summarize count() by OutputFile | order by count_ desc

DeviceProcessEvents | where ProcessCommandLine contains 'dd' and ProcessCommandLine contains '/proc/' and ProcessCommandLine contains 'mem' | project TimeGenerated, ProcessId, ProcessCommandLine | extend OutputFile=extract("of=([^ ]+)", 1, ProcessCommandLine) | where isnotempty(OutputFile)

DeviceProcessEvents | where ProcessCommandLine contains "dd" and ProcessCommandLine contains "/proc/" and ProcessCommandLine contains "/mem" | project InitiatingProcessCommandLine, FileName

DeviceProcessEvents | where ProcessCommandLine contains "dd" | where ProcessCommandLine contains "/proc/" and ProcessCommandLine contains "mem" | extend OutputFile = extract("of=([^\\s]+)", 1, ProcessCommandLine) | project Timestamp, DeviceName, ProcessCommandLine, OutputFile, AccountName, InitiatingProcessFileName | order by Timestamp desc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where FileName == "dd" | where ProcessCommandLine contains "/proc/" and ProcessCommandLine contains "mem" | extend OutputFile = extract(@"of=([^ ]+)", 1, ProcessCommandLine) | project Timestamp, ProcessCommandLine, OutputFile | summarize arg_max(Timestamp, *) by OutputFile

DeviceProcessEvents | where ActionType in ("CreateProcess", "ProcessCreated") | project TimeGenerated, DeviceId, DeviceName, ProcessCommandLine // Join with DeviceInfo to ensure we only look at Linux systems | join kind=inner ( DeviceInfo | project DeviceId, OSPlatform ) on DeviceId | where OSPlatform == "Linux" | where ProcessCommandLine has "dd " and ProcessCommandLine has "if=/proc/" and ProcessCommandLine has "/mem" and ProcessCommandLine has " of=" | parse kind=regex ProcessCommandLine with * "if=" Source " of=" DumpFile " " * | project TimeGenerated, DeviceName, Source, DumpFile | order by TimeGenerated desc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ActionType == "ProcessCreated" | where FileName =~ "dd" | where ProcessCommandLine has "if=/proc/" and ProcessCommandLine has "/mem" | extend DumpedFile = extract(@"of=([^\s]+)",1,ProcessCommandLine) | where isnotempty(DumpedFile) | project TimeGenerated, DeviceName, ProcessCommandLine, DumpedFile | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has "dd" | where InitiatingProcessCommandLine has "if=/proc/" and InitiatingProcessCommandLine has "mem" | extend dump_file = extract(@"of=(\S+)", 1, InitiatingProcessCommandLine) | where isnotempty(dump_file) | project TimeGenerated, InitiatingProcessCommandLine, dump_file

DeviceProcessEvents | where ProcessCommandLine has "dd" | where ProcessCommandLine has "if=/proc/" and ProcessCommandLine has "mem" | extend DumpFile = extract(@"of=([^ \t]+)", 1, ProcessCommandLine) | where isnotempty(DumpFile) | project TimeGenerated, ProcessCommandLine, DumpFile | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "dd" and ProcessCommandLine has "if=/proc/" | extend DumpFile = extract(@"of=(\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, DumpFile