Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner DeviceInfo on DeviceId | where OSPlatform == "Linux" | where ProcessCommandLine contains "=" and ProcessCommandLine contains "|" | extend parts = split(ProcessCommandLine, '|') | extend commandBeforeFirstPipe = tostring(parts[0]) | extend commandAfterFirstPipe = tostring(parts[1]) | where commandAfterFirstPipe matches regex @"^\s*(?:/bin/)?(?:bash|sh|zsh|ksh|csh)" // Ensure the command after the pipe starts with a shell | extend potentialVariableMatches = extract_all(@'([a-zA-Z_][a-zA-Z0-9_]*)=' , commandBeforeFirstPipe) | where array_length(potentialVariableMatches) > 0 | mv-expand potentialVariableMatches // Each element of potentialVariableMatches is an array like ["VariableName"] | project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, AssignedVariable = tostring(potentialVariableMatches[0]) // Access the first element of the inner array

DeviceProcessEvents | where ProcessCommandLine has 'set' and ProcessCommandLine has '|' | extend ExtractedCommand = extract(@'(?i)set (?<VariableName>[^= ]*)=.*\|', 1, ProcessCommandLine) | project ProcessId, ProcessCommandLine, ExtractedCommand

DeviceProcessEvents | where FileName in ('bash', 'sh', 'zsh', 'csh', 'ksh', 'dash', 'tcsh') | where ProcessCommandLine contains '=' and ProcessCommandLine contains '|' | extend EnvVar = extract_all('(\\w+)=', ProcessCommandLine) | mv-expand EnvVar to typeof(string) | summarize Count = count() by tostring(EnvVar) | order by Count desc

DeviceProcessEvents | where FileName in ('bash', 'sh') or InitiatingProcessCommandLine contains 'bash' or InitiatingProcessCommandLine contains 'sh' | where InitiatingProcessCommandLine contains 'export ' or InitiatingProcessCommandLine contains 'environment=' | extend envVarNames = extract_all(@'\$(\w+)', InitiatingProcessCommandLine) | mv-expand envVarNames | where InitiatingProcessCommandLine contains '|' and (InitiatingProcessCommandLine contains 'bash' or InitiatingProcessCommandLine contains 'sh') | project timestamp=InitiatingProcessCreationTime, ProcessId, FileName, InitiatingProcessCommandLine, envVarNames | summarize count() by tostring(envVarNames), bin(timestamp, 1h)

let shell_processes = DeviceProcessEvents | where InitiatingProcessFileName in~ ("sh", "bash", "dash", "zsh", "ksh") or FileName in~ ("sh", "bash", "dash", "zsh", "ksh"); shell_processes | where InitiatingProcessCommandLine contains "export" and InitiatingProcessCommandLine contains "|" | extend EnvVariableName = extract(@"export\s+(\w+)=", 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessFileName, EnvVariableName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has "export" and ProcessCommandLine has "|" | where FileName has_any ("bash", "sh", "zsh", "ksh") | extend env_var = extract(@"export\s+([A-Za-z_][A-Za-z0-9_]*)=", 1, ProcessCommandLine) | where isnotempty(env_var) | summarize count() by env_var, ProcessCommandLine | project env_var

DeviceProcessEvents | where FileName in ("bash", "sh", "zsh", "dash") | where ProcessCommandLine matches regex @"(?<varName>[A-Za-z_][A-Za-z0-9_]*)=.*\|\s*(bash|sh|zsh|dash)" | extend EnvVariable = extract(@"([A-Za-z_][A-Za-z0-9_]*)=", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessId, FileName, EnvVariable, ProcessCommandLine | distinct EnvVariable