On a Linux system, spotting a file‐size change by exactly one byte can indicate hash tampering via padding. Review process execution logs for invocations that increased a file’s size by one byte. Which utility was invoked to perform this padding?

DeviceFileEvents
| where isnotempty(PreviousFileName) or true
| project TimeGenerated, DeviceId, FileName, FileSize, InitiatingProcessFileName
| join kind=inner (
    DeviceFileEvents
    | project PreviousTimeGenerated = TimeGenerated, DeviceIdPrev = DeviceId, PreviousFileName = FileName, PreviousFileSize = FileSize
) on $left.DeviceId == $right.DeviceIdPrev and $left.FileName == $right.PreviousFileName
| where TimeGenerated > PreviousTimeGenerated
| where FileSize == PreviousFileSize + 1
| summarize Count = count() by InitiatingProcessFileName
| order by Count desc
| project Utility = InitiatingProcessFileName, Count

let LinuxDevices = DeviceInfo
| where OSPlatform =~ "Linux"
| project DeviceId;
DeviceFileEvents
| where ActionType in~ ("FileModified", "FileCreated")
| where isnotnull(FileSize)
| join kind=inner (LinuxDevices) on DeviceId
| extend Folder = iff(isempty(FolderPath), "", trim_end("/", FolderPath))
| extend FilePath = iff(isempty(Folder), FileName, strcat(Folder, "/", FileName))
| where isnotempty(FilePath)
| extend FileKey = strcat(DeviceId, "||", FilePath)
| project TimeGenerated, ReportId, DeviceId, DeviceName, FilePath, FileName, FolderPath, FileSize,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName, FileKey
| order by FileKey asc, TimeGenerated asc, ReportId asc
| serialize
| extend PrevKey = prev(FileKey), PrevSize = tolong(prev(FileSize))
| extend Delta = iif(FileKey == PrevKey and isnotnull(PrevSize), tolong(FileSize) - PrevSize, long(null))
| where Delta == 1
| where isnotempty(InitiatingProcessFileName)
| summarize PaddingEvents = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ExampleCmd = any(InitiatingProcessCommandLine)
          by Utility = tolower(InitiatingProcessFileName)
| order by PaddingEvents desc, LastSeen desc

// Identify Linux devices (adjust OSPlatform/OSDistribution checks as needed)
let linuxDevices = DeviceInfo
| where isnotempty(OSPlatform) and tolower(OSPlatform) has "linux"
| distinct DeviceId;

// Find file events for those devices and compute previous observed size (prev event or AdditionalFields.PreviousFileSize)
let hits = DeviceFileEvents
| where DeviceId in (linuxDevices)
| order by DeviceId, FolderPath, FileName, TimeGenerated asc
| serialize
| extend previous_file_size_field = tolong(AdditionalFields["PreviousFileSize"])
| extend prev_event_file_size = prev(FileSize)
| extend prevSize = coalesce(prev_event_file_size, previous_file_size_field)
| where isnotempty(prevSize) and FileSize - prevSize == 1
| project TimeGenerated, DeviceName, DeviceId, FolderPath, FileName, prevSize, FileSize, delta = FileSize - prevSize, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, ActionType, AdditionalFields;

// Summary: which initiating utilities/command-lines caused the 1-byte padding
hits
| summarize occurrences = count(), firstSeen = min(TimeGenerated), lastSeen = max(TimeGenerated) by InitiatingProcessFileName, InitiatingProcessCommandLine
| order by occurrences desc
| limit 50

let lookback = 1h; // adjust if needed; time range should normally be set by the caller
// Collect relevant file events
DeviceFileEvents
| where isnotempty(FileSize) and isnotempty(FileName)
| extend FileKey = strcat(DeviceId, "|", FolderPath, "|", FileName)
| sort by FileKey asc, TimeGenerated asc
| serialize
| extend PrevFileKey = prev(FileKey),
         PrevTimeGenerated = prev(TimeGenerated),
         PrevFileSize = prev(FileSize),
         PrevInitiatingProcessFileName = prev(InitiatingProcessFileName),
         PrevInitiatingProcessCommandLine = prev(InitiatingProcessCommandLine),
         PrevInitiatingProcessId = prev(InitiatingProcessId),
         PrevInitiatingProcessAccountName = prev(InitiatingProcessAccountName)
// Only consider consecutive records for the same file
| where FileKey == PrevFileKey
// Size increased by exactly one byte
| where FileSize == PrevFileSize + 1
// Optional: only consider quick modifications (within lookback)
| where TimeGenerated - PrevTimeGenerated <= lookback
| extend TimeDelta = TimeGenerated - PrevTimeGenerated
| extend InitiatingProc = coalesce(InitiatingProcessFileName, InitiatingProcessCommandLine),
         PrevInitiatingProc = coalesce(PrevInitiatingProcessFileName, PrevInitiatingProcessCommandLine)
// Attempt to identify the utility used for padding by checking common tool names in current or previous initiating process fields
| extend LikelyUtility = case(
    tolower(InitiatingProc) contains "truncate", InitiatingProc,
    tolower(InitiatingProc) contains "dd", InitiatingProc,
    tolower(InitiatingProc) contains "echo", InitiatingProc,
    tolower(InitiatingProc) contains "printf", InitiatingProc,
    tolower(InitiatingProc) contains "fallocate", InitiatingProc,
    tolower(InitiatingProc) contains "sed", InitiatingProc,
    tolower(InitiatingProc) contains "awk", InitiatingProc,
    tolower(InitiatingProc) contains "python", InitiatingProc,
    tolower(InitiatingProc) contains "perl", InitiatingProc,
    tolower(PrevInitiatingProc) contains "truncate", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "dd", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "echo", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "printf", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "fallocate", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "sed", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "awk", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "python", PrevInitiatingProc,
    tolower(PrevInitiatingProc) contains "perl", PrevInitiatingProc,
    "Unknown")
| project TimeGenerated, DeviceName, DeviceId, FolderPath, FileName, PrevFileSize, FileSize, TimeDelta,
          InitiatingProcessId = InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName,
          PrevInitiatingProcessId, PrevInitiatingProcessFileName, PrevInitiatingProcessCommandLine, PrevInitiatingProcessAccountName,
          LikelyUtility
| order by TimeGenerated desc
| take 200

// 1) base set of file events
let fileEvents = DeviceFileEvents
| where isnotempty(FileName) and isnotempty(FileSize)
| project TimeGenerated, DeviceName, FolderPath, FileName, FileSize, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, AdditionalFields;

// 2) Method A: parse AdditionalFields for explicit previous-size fields
let fromAdditional = fileEvents
| extend af = todynamic(AdditionalFields)
| extend prevSize = tolong(coalesce(af.PreviousFileSize, af.PreviousSize, af.OldFileSize, af.OriginalFileSize, af.OldSize, af.PreviousFileSizeInBytes))
| where isnotempty(prevSize) and FileSize - prevSize == 1
| extend Source = "additional_field";

// 3) Method B: compare against immediate prior observed event for same file
let fromOrdering = fileEvents
| sort by DeviceName asc, FolderPath asc, FileName asc, TimeGenerated asc
| serialize
| extend prevDevice = prev(DeviceName), prevFolder = prev(FolderPath), prevFile = prev(FileName), prevSize = prev(FileSize), prevTime = prev(TimeGenerated)
| where DeviceName == prevDevice and FolderPath == prevFolder and FileName == prevFile and isnotempty(prevSize) and FileSize - prevSize == 1
| extend Source = "ordering_prev";

// 4) Combine and summarize which utilities/commands invoked
union fromAdditional, fromOrdering
| project Source, TimeGenerated, DeviceName, FolderPath, FileName, prevSize, FileSize, SizeDelta = FileSize - prevSize, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| summarize Hits = count(), ExampleEvent = any(pack_all()) by InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Hits desc
| take 50

// Optional: to inspect raw matching events instead of the summary, remove the summarize and project the detailed rows above.

DeviceInfo
| where OSPlatform == 'Linux'
| project DeviceId
| join kind=inner (
    DeviceFileEvents
    | where ActionType == 'FileModified'
    | where FileSize == 1
    | summarize Utilities = make_set(InitiatingProcessFileName) by DeviceId
) on DeviceId
| project Utilities
| summarize make_set(Utilities)

// --- Linux one-byte file-growth detector ----------------------------
let LinuxDevices = DeviceInfo
| where OSPlatform startswith "Linux"
| project DeviceId, DeviceName;
DeviceFileEvents
| where ActionType in ("FileCreated","FileWritten","FileModified","FileContentModified")
| join kind=inner (LinuxDevices) on DeviceId
| extend FilePath = strcat(FolderPath, "/", FileName)
| sort by DeviceId, FilePath, TimeGenerated asc
| serialize                 // preserve the sorted order for prev()
| extend PrevDeviceId  = prev(DeviceId),
         PrevFilePath  = prev(FilePath),
         PrevSize      = prev(FileSize)
| where DeviceId == PrevDeviceId and FilePath == PrevFilePath and isnotempty(PrevSize)
| extend SizeDelta = FileSize - PrevSize
| where SizeDelta == 1      // grew by exactly one byte
// ---------------------------------------------------------------------
| summarize Events      = count(),
            FirstSeen   = min(TimeGenerated),
            LastSeen    = max(TimeGenerated),
            ExampleCmd  = arg_max(TimeGenerated, InitiatingProcessCommandLine)
        by InitiatingProcessFileName
| order by Events desc