Question Analysis

DeviceFileEvents | where (FolderPath == '/etc' and FileName == 'profile') or (FolderPath == '/etc/' and FileName == 'profile') or (FolderPath == '/etc/profile') or (FolderPath == '/etc/' and FileName == '/profile') // Also search where full path is embedded, in case FolderPath isn't split correctly | union (DeviceFileEvents | where FolderPath == '/etc' and FileName contains 'profile') | where ActionType in ('FileCreated', 'FileModified', 'FileWritten') | project TimeGenerated, DeviceName, DeviceId, ActionType, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessSHA256, ReportId | order by TimeGenerated desc

DeviceFileEvents | where ActionType in ("FileModified", "FileCreated") | where FolderPath startswith "/etc" and FileName == "profile" | project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, ActionType, DeviceId

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | project DeviceId, DeviceName, OSPlatform; DeviceFileEvents | where FolderPath has "/etc/profile" or FileName has "profile" | where ActionType in ("FileModified", "FileCreated", "FileRenamed") | join kind=inner (linuxDevices) on DeviceId | project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | union ( DeviceProcessEvents | where ProcessCommandLine has "/etc/profile" or InitiatingProcessCommandLine has "/etc/profile" | join kind=inner (linuxDevices) on DeviceId | project TimeGenerated, DeviceName, ActionType, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName ) | order by TimeGenerated desc

DeviceFileEvents | where ActionType in~ ('FileModified', 'FileCreated') | join kind=inner (DeviceInfo | where OSPlatform == 'Linux' | project DeviceId, DeviceName) on DeviceId | where FolderPath has '/etc/profile' or (FolderPath has '/etc' and FileName has 'profile') | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine, InitiatingProcessFileName | order by TimeGenerated desc | limit 100

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceFileEvents | where DeviceId in (LinuxDevices) | where ActionType in ("FileModified","FileCreated") | where FolderPath has "/etc" and FileName == "profile" | project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessParentId | order by TimeGenerated desc

let fileModEvents = DeviceFileEvents | where FileName == "profile" | where FolderPath has "/etc" // Look for modification or append actions (case-insensitive) or additional fields mentioning append | where ActionType has_any ("Modified", "modified", "Append", "append") or tostring(AdditionalFields) has_cs "append" | project TimeGenerated, DeviceName, FolderPath, FileName, CommandLine = InitiatingProcessCommandLine, ActionType, AdditionalFields; let processModEvents = DeviceProcessEvents // Search for redirection operator (>>), allowing any whitespace between >> and /etc/profile | where coalesce(ProcessCommandLine, InitiatingProcessCommandLine) matches regex @".*>>\s*/etc/profile.*" | project TimeGenerated, DeviceName, FolderPath, FileName, CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine), ActionType; fileModEvents | union processModEvents | sort by TimeGenerated desc

union ( // File modification events on /etc/profile DeviceFileEvents | where (FolderPath == "/etc" or FolderPath has "/etc") and FileName =~ "profile" and ActionType contains "Modified" | extend CommandInvocation = InitiatingProcessCommandLine, Source = "FileModificationEvent" ), ( // Process events with command line that appends to /etc/profile using redirection DeviceProcessEvents | where ProcessCommandLine contains ">>" and ProcessCommandLine contains "/etc/profile" | extend CommandInvocation = ProcessCommandLine, Source = "ProcessEvent" ) | project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, CommandInvocation, Source | order by TimeGenerated desc

let LinuxDeviceIds = DeviceInfo | where OSPlatform startswith "Linux" | distinct DeviceId; let FileMods = DeviceFileEvents | where DeviceId in (LinuxDeviceIds) | where FolderPath has "/etc" and FileName == "profile" | where ActionType has "Modified" or ActionType has "Overwritten" | extend FilePath = strcat(FolderPath, "/", FileName) | project TimeGenerated, DeviceId, DeviceName, FilePath, ActionType, InitiatingProcessId; let FileModCommands = FileMods | join kind=leftouter ( DeviceProcessEvents | where DeviceId in (LinuxDeviceIds) | project DeviceId, ProcessId, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCreationTime, ProcessCommandLine ) on DeviceId, $left.InitiatingProcessId == $right.ProcessId | project TimeGenerated, DeviceName, FilePath, ActionType, ProcessCreationTime, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine; let DirectAppends = DeviceProcessEvents | where DeviceId in (LinuxDeviceIds) | where ProcessCommandLine has ">> /etc/profile" or ProcessCommandLine has "tee -a /etc/profile" | project TimeGenerated, DeviceName, FilePath = "/etc/profile", ActionType = "Direct Append", ProcessCreationTime, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine; FileModCommands | union DirectAppends | sort by TimeGenerated desc

let fileModifications = DeviceFileEvents | where ActionType == "FileModified" | where FolderPath == "/etc" and FileName == "profile" | project TimeGenerated, SourceEvent = "FileModified", DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessId, ProcessCommandLine = InitiatingProcessCommandLine; let processWrites = DeviceProcessEvents | where ProcessCommandLine matches regex @"(>>|tee).*?/etc/profile" | project TimeGenerated, SourceEvent = "ProcessWrite", DeviceName, InitiatingProcessAccountName = AccountName, InitiatingProcessFileName = FileName, InitiatingProcessId = ProcessId, ProcessCommandLine; union fileModifications, processWrites | sort by TimeGenerated desc