Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where (ProcessCommandLine contains "usermod" and (ProcessCommandLine contains "-U" or ProcessCommandLine contains "-e")) or (ProcessCommandLine contains "chage" and ProcessCommandLine contains "-E") or (ProcessCommandLine contains "passwd" and ProcessCommandLine contains "-u") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceProcessEvents | where ActionType == 'ProcessCreated' | where FileName in ('usermod', 'passwd') and ProcessCommandLine has_any ('-U', 'unlock') | project DeviceName, FileName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where FileName in~ ('usermod','passwd','chage','gpasswd','vipw','vigr') | where ProcessCommandLine has_any('--unlock','-U','--expiredate','passwd') | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine

DeviceProcessEvents | where FileName in ("usermod", "passwd", "chage", "gpasswd") or ProcessCommandLine has_any ("usermod", "passwd", "chage", "gpasswd") | where ProcessCommandLine has_any ("reactivate", "unlock", "unlocked", "lock", "locked", "expire", "expired", "activate", "activated") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName | summarize count(), make_list(ProcessCommandLine, 10) by FileName, AccountName | order by count_ desc

DeviceProcessEvents | where ActionType == 'ProcessCreated' | where ProcessCommandLine contains 'usermod' or ProcessCommandLine contains 'chage' or ProcessCommandLine contains 'passwd' | where ProcessCommandLine contains '-U' or ProcessCommandLine contains '-E' // Filtering for unlock (-U) or expiration-related (-E) options | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FileName | order by TimeGenerated desc

// Replace YOUR_TIME_FILTER with your desired time filter, e.g. TimeGenerated >= ago(7d) DeviceInfo | where OSPlatform == "Linux" | join kind=inner ( DeviceProcessEvents | where ActionType == "ProcessCreated" // you can adjust the file names or commands as needed | where FileName in~ ("passwd", "usermod", "chage") // look for keywords typical of reactivating/unlocking accounts | where ProcessCommandLine has_any ("unlock", "-u", "-U", "--unlock") ) on DeviceId | where TimeGenerated >= ago(7d) // or your custom time filter | project TimeGenerated, DeviceName, InitiatingProcessAccountName, AccountName, FileName, ProcessCommandLine, FolderPath | order by TimeGenerated desc

DeviceProcessEvents | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | project DeviceId ) on DeviceId | where ActionType == "ProcessCreated" | where FileName in~ ("passwd", "chage", "usermod", "chpasswd") | where ProcessCommandLine has_any (" -u", " -U", " -e", " -E", "unlock", "unexpire") | project TimeGenerated, DeviceName, AccountDomain, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine | order by TimeGenerated desc | limit 100

DeviceProcessEvents // Timerange is set externally via function parameters | where FileName in ("usermod", "passwd", "chage") | where ProcessCommandLine has_any ("-U", "--unlock", "unlock") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName | distinct TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName

DeviceProcessEvents | where FileName has_any ("usermod", "passwd") | where ProcessCommandLine contains "-U" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceProcessEvents // Limit to process creation events | where ActionType in ("ProcessCreated", "Start", "ProcessStart") // Focus on known user account management utilities | where FileName in ("passwd", "usermod", "chage", "gpasswd") // Look for flags related to unlocking or re‐enabling accounts | extend Cmd = ProcessCommandLine | where Cmd has_any ("--unlock", "-u", "-U", "--expire", "-E") // Only successful operations (if exit code is captured) | extend ExitCode = toint(AdditionalFields.ExitCode) | where isnull(ExitCode) or ExitCode == 0 // Restrict to Linux devices | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | project DeviceId, OSPlatform ) on DeviceId // Present the key details | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, ExitCode | sort by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName in ("passwd", "usermod", "chage") | extend LowerCmd = tolower(ProcessCommandLine) // passwd unlock flags, usermod unlock flags, chage expiredate flags | where (FileName == "passwd" and (LowerCmd contains "-u " or LowerCmd contains "--unlock")) or (FileName == "usermod" and (LowerCmd contains "-u " or LowerCmd contains "--unlock")) or (FileName == "chage" and (LowerCmd contains "-e " or LowerCmd contains "--expiredate")) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine | order by TimeGenerated asc