Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend OutputFilename = trim_start(' ', substring(ProcessCommandLine, indexof(ProcessCommandLine, '>') + 1)) | project Timestamp, DeviceName, AccountName, ProcessCommandLine, OutputFilename

DeviceProcessEvents | where ProcessCommandLine contains ".config/chromium" and (ProcessCommandLine contains "find" and (ProcessCommandLine contains ">" or ProcessCommandLine contains ">>" or ProcessCommandLine contains "|")) | extend target_file = extract_all(@"(?:[|]|>>?)\s*([^\s>]+)", ProcessCommandLine) | mv-expand target_file to typeof(string) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, target_file

DeviceProcessEvents | where ProcessCommandLine has '.config/chromium' and (ProcessCommandLine has '.json' or ProcessCommandLine has 'Bookmarks') | where ProcessCommandLine has_any (">", ">>") | where ProcessCommandLine matches regex @'\b(find|grep|cat)\b' | extend OutputFile = extract(@'>\s*([^ >]+)', 1, ProcessCommandLine) | summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, ProcessCommandLine, OutputFile | project DeviceName, FirstSeen, LastSeen, ProcessCommandLine, OutputFile, Count | order by FirstSeen asc

DeviceProcessEvents | where ProcessCommandLine has_any ("find", "grep") and ProcessCommandLine has ".config/chromium" | where ProcessCommandLine contains ">" or ProcessCommandLine contains "tee" | extend OutputFile = extract(@"[>|] ?([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, ProcessCommandLine, OutputFile | order by TimeGenerated asc

DeviceProcessEvents | where ProcessCommandLine contains ".config/chromium" | where ProcessCommandLine matches regex "(find|grep|ls)" | where ProcessCommandLine contains ">" or ProcessCommandLine contains ">>" | extend OutputFile = extract(">>?.*?([\\/]?[\\/a-zA-Z0-9._-]+)", 1, ProcessCommandLine) | project Timestamp, DeviceName, AccountName, ProcessCommandLine, OutputFile | order by Timestamp desc

DeviceProcessEvents | join kind=inner (DeviceInfo | where OSPlatform == 'Linux' | project DeviceId, DeviceName) on DeviceId | where ProcessCommandLine contains '.config/chromium' and ProcessCommandLine contains '>' | extend Filename = extract(@' > \"([^\"]+)\"| > ([^ ]+)', 1, ProcessCommandLine) // Extracts filename after '>' , handling quoted or unquoted paths | project TimeGenerated, DeviceName, ProcessCommandLine, Filename | summarize arg_max(TimeGenerated, *) by Filename // Summarizes to show the latest occurrence per filename

DeviceProcessEvents | join kind=inner ( DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId ) on DeviceId | where ProcessCommandLine has ".config/chromium" and (ProcessCommandLine contains ">" or ProcessCommandLine contains ">>") | extend SavedFile = extract(@"(?:>|>>)\s+([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, SavedFile | summarize UniqueFilenames = make_set(SavedFile)

DeviceProcessEvents | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend SavedFile = extract(@">\s*([^\s]+)", 1, ProcessCommandLine) | where isnotempty(SavedFile) | summarize by SavedFile | project SavedFile

DeviceProcessEvents | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend outputFile = extract(@">\s*([^\s]+)", 1, ProcessCommandLine) | where isnotempty(outputFile) | project TimeGenerated, DeviceName, ProcessCommandLine, outputFile | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName in ("bash","sh","dash","zsh") | where ProcessCommandLine has ".config/chromium" and ProcessCommandLine has ">" | extend SavedFile = extract("[>]{1,2}\\s*['\"`]?([^'\"`;&| ]+)", 1, ProcessCommandLine) | where isnotempty(SavedFile) | distinct SavedFile

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) // Only Chromium config paths and ProcessCommandLine has ".config/chromium" // Common shell search utilities and (ProcessCommandLine has "find" or ProcessCommandLine has "grep" or ProcessCommandLine has "locate") // Redirecting output to a file and ProcessCommandLine matches regex @">>?\s+\S+" | extend OutputFile = extract(@"[>]{1,2}\s*(\S+)", 1, ProcessCommandLine) | project Timestamp = TimeGenerated, DeviceName, Shell = InitiatingProcessFileName, CommandLine = ProcessCommandLine, OutputFile | order by Timestamp asc