Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend OutputFilename = trim_start(' ', substring(ProcessCommandLine, indexof(ProcessCommandLine, '>') + 1)) | project Timestamp, DeviceName, AccountName, ProcessCommandLine, OutputFilename

DeviceProcessEvents | where ProcessCommandLine contains ".config/chromium" and (ProcessCommandLine contains "find" and (ProcessCommandLine contains ">" or ProcessCommandLine contains ">>" or ProcessCommandLine contains "|")) | extend target_file = extract_all(@"(?:[|]|>>?)\s*([^\s>]+)", ProcessCommandLine) | mv-expand target_file to typeof(string) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, target_file

DeviceProcessEvents | where ProcessCommandLine has '.config/chromium' and (ProcessCommandLine has '.json' or ProcessCommandLine has 'Bookmarks') | where ProcessCommandLine has_any (">", ">>") | where ProcessCommandLine matches regex @'\b(find|grep|cat)\b' | extend OutputFile = extract(@'>\s*([^ >]+)', 1, ProcessCommandLine) | summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, ProcessCommandLine, OutputFile | project DeviceName, FirstSeen, LastSeen, ProcessCommandLine, OutputFile, Count | order by FirstSeen asc

DeviceProcessEvents | where ProcessCommandLine has_any ("find", "grep") and ProcessCommandLine has ".config/chromium" | where ProcessCommandLine contains ">" or ProcessCommandLine contains "tee" | extend OutputFile = extract(@"[>|] ?([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, ProcessCommandLine, OutputFile | order by TimeGenerated asc

// Find process events on Linux where commands search under ~/.config/chromium and redirect output to a file let redirect_ops = @"(>|\|\s*tee\b|2>\s*|&>\s*)"; let chromium_path_pattern = @"\.config/chromium"; let bookmark_keywords = dynamic(["Bookmarks","Bookmarks.bak","bookmark","bookmark*","*Bookmarks*"]); // Search DeviceProcessEvents (more detailed process telemetry) and DeviceEvents (fallback) for command lines ( DeviceProcessEvents | where ProcessCommandLine has_cs ".config/chromium" or InitiatingProcessCommandLine has_cs ".config/chromium" | where ProcessCommandLine matches regex @".*(Bookmarks|Bookmarks\.bak|bookmark).*" or InitiatingProcessCommandLine matches regex @".*(Bookmarks|Bookmarks\.bak|bookmark).*" | where ProcessCommandLine contains ">" or ProcessCommandLine contains "tee" or ProcessCommandLine contains "2>" or ProcessCommandLine contains "&>" | extend CommandLine = tostring(ProcessCommandLine), Time = ProcessCreationTime, Device = DeviceName, PID = ProcessId, InitiatingCommandLine = tostring(InitiatingProcessCommandLine) ) | union ( DeviceEvents | where ProcessCommandLine has_cs ".config/chromium" or InitiatingProcessCommandLine has_cs ".config/chromium" | where ProcessCommandLine matches regex @".*(Bookmarks|Bookmarks\.bak|bookmark).*" or InitiatingProcessCommandLine matches regex @".*(Bookmarks|Bookmarks\.bak|bookmark).*" | where ProcessCommandLine contains ">" or ProcessCommandLine contains "tee" or ProcessCommandLine contains "2>" or ProcessCommandLine contains "&>" | extend CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine), Time = TimeGenerated, Device = DeviceName, PID = ProcessId ) | extend OutputFile = extract(@"(?:>\s*|tee\s+|2>\s*|&>\s*)([^\s;|]+)", 1, CommandLine) | project Time, Device, PID, FileName, CommandLine, InitiatingCommandLine, OutputFile | where isnotempty(OutputFile) | summarize count() , any(Device) , any(FileName) by OutputFile, tostring(CommandLine) | order by count_ desc | take 50

union isfuzzy=true DeviceProcessEvents, DeviceEvents | extend cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) // Only consider records that mention chromium config and a save/redirect operation | where isnotempty(cmd) and cmd contains ".config/chromium" and (cmd contains ">" or cmd contains "tee" or cmd contains "curl -o" or cmd contains "wget -O" or cmd contains ">>") // Try multiple patterns to capture the target filename for redirects, tee and curl/wget -o/-O | extend outfile = coalesce( extract("(?:>>|>)[ \t]*([^ \t;|]+)", 1, cmd), extract("\\btee(?:[ \t]+-[^ \t]+[ \t]*)*[ \t]+([^ \t;|]+)", 1, cmd), extract("(?:curl|wget)[^;|]*?(?:-o|-O)[ \t]*([^ \t;|]+)", 1, cmd) ) | where isnotempty(outfile) | extend outfile = trim("'\";| ", outfile) | project TimeGenerated, DeviceName, AccountName, ProcessFileName = coalesce(FileName, InitiatingProcessFileName), cmd, outfile | order by TimeGenerated desc

let linuxDevices = DeviceInfo | where tolower(OSPlatform) has "linux" | distinct DeviceId; union DeviceProcessEvents, DeviceEvents | where DeviceId in (linuxDevices) | where (isnotempty(ProcessCommandLine) and tolower(ProcessCommandLine) contains ".config/chromium") or (isnotempty(InitiatingProcessCommandLine) and tolower(InitiatingProcessCommandLine) contains ".config/chromium") | extend cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | where cmd matches regex @".*(>|>>|\|\s*tee).*" | extend outputFile = extract(@"(?:>\s*|>>\s*|\|\s*tee(?:\s+-a)?\s+)([^ \t\n;|]+)", 1, cmd) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, ProcessId, cmd, outputFile | order by TimeGenerated desc

DeviceProcessEvents | where isnotempty(InitiatingProcessCommandLine) | where InitiatingProcessCommandLine contains_cs ".config/chromium" // Linux Chromium config path (case sensitive) | where ( InitiatingProcessCommandLine contains_cs "grep" or InitiatingProcessCommandLine contains_cs "find" or InitiatingProcessCommandLine contains_cs "rg" or InitiatingProcessCommandLine contains_cs "locate" or InitiatingProcessCommandLine contains_cs "fd" or InitiatingProcessCommandLine contains_cs "ripgrep" ) | where InitiatingProcessCommandLine contains_cs ">" or InitiatingProcessCommandLine contains_cs ">>" | extend RedirectTargetRaw = extract(@">\s*(.*)$", 1, InitiatingProcessCommandLine) | extend RedirectTarget = RedirectTargetRaw | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, RedirectTarget

DeviceProcessEvents | where TimeGenerated >= ago(30d) | extend CmdLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | extend FolderPath = coalesce(InitiatingProcessFolderPath, FolderPath) | where tolower(FolderPath) contains ".config/chromium" or tolower(CmdLine) contains ".config/chromium" | where (tolower(CmdLine) contains "grep" or tolower(CmdLine) contains "find" or tolower(CmdLine) contains "grep -R" or tolower(CmdLine) contains "grep -r") | where (tolower(CmdLine) contains ">" or tolower(CmdLine) contains ">>" or tolower(CmdLine) contains "tee") | extend OutputFile = tostring(coalesce(extract("[>]{1,2}\\s*([^\\s]+)$", 1, CmdLine), extract("tee\\s+([^\\s]+)$", 1, CmdLine))) | project TimeGenerated, DeviceId, DeviceName, CmdLine, FolderPath, OutputFile

DeviceProcessEvents | where ProcessCommandLine contains ".config/chromium" | where ProcessCommandLine matches regex "(find|grep|ls)" | where ProcessCommandLine contains ">" or ProcessCommandLine contains ">>" | extend OutputFile = extract(">>?.*?([\\/]?[\\/a-zA-Z0-9._-]+)", 1, ProcessCommandLine) | project Timestamp, DeviceName, AccountName, ProcessCommandLine, OutputFile | order by Timestamp desc

DeviceProcessEvents | join kind=inner (DeviceInfo | where OSPlatform == 'Linux' | project DeviceId, DeviceName) on DeviceId | where ProcessCommandLine contains '.config/chromium' and ProcessCommandLine contains '>' | extend Filename = extract(@' > \"([^\"]+)\"| > ([^ ]+)', 1, ProcessCommandLine) // Extracts filename after '>' , handling quoted or unquoted paths | project TimeGenerated, DeviceName, ProcessCommandLine, Filename | summarize arg_max(TimeGenerated, *) by Filename // Summarizes to show the latest occurrence per filename

DeviceProcessEvents | join kind=inner ( DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId ) on DeviceId | where ProcessCommandLine has ".config/chromium" and (ProcessCommandLine contains ">" or ProcessCommandLine contains ">>") | extend SavedFile = extract(@"(?:>|>>)\s+([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, SavedFile | summarize UniqueFilenames = make_set(SavedFile)

DeviceProcessEvents | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend SavedFile = extract(@">\s*([^\s]+)", 1, ProcessCommandLine) | where isnotempty(SavedFile) | summarize by SavedFile | project SavedFile

DeviceProcessEvents | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend outputFile = extract(@">\s*([^\s]+)", 1, ProcessCommandLine) | where isnotempty(outputFile) | project TimeGenerated, DeviceName, ProcessCommandLine, outputFile | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName in ("bash","sh","dash","zsh") | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend SavedFile = extract("[>]{1,2}\\s*['\"`]?([^'\"`;&| ]+)", 1, ProcessCommandLine) | where isnotempty(SavedFile) | distinct SavedFile

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) // Only Chromium config paths and ProcessCommandLine has ".config/chromium" // Common shell search utilities and (ProcessCommandLine has "find" or ProcessCommandLine has "grep" or ProcessCommandLine has "locate") // Redirecting output to a file and ProcessCommandLine matches regex @">>?\s+\S+" | extend OutputFile = extract(@"[>]{1,2}\s*(\S+)", 1, ProcessCommandLine) | project Timestamp = TimeGenerated, DeviceName, Shell = InitiatingProcessFileName, CommandLine = ProcessCommandLine, OutputFile | order by Timestamp asc