Using Linux process execution logs, identify the specific command that was used to filter loaded kernel modules for entries containing “vmw.” What was that full command?

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine contains "lsmod" and ProcessCommandLine contains "vmw"
| distinct ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains 'vmw' | summarize Count=count() by ProcessCommandLine | project ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine has 'lsmod' and ProcessCommandLine has 'vmw' and (ProcessCommandLine contains 'grep' or ProcessCommandLine contains 'awk')
| summarize count() by ProcessCommandLine
| order by count_ desc
| project ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine has_any ('lsmod', 'cat /proc/modules') and ProcessCommandLine has 'grep vmw'
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
| distinct ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine contains "lsmod" and ProcessCommandLine contains "vmw"
| distinct ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine contains 'vmw'
| where ProcessCommandLine matches regex '(grep|cat|awk)' // Filtering commands likely used for filtering kernel modules
| project TimeGenerated, ProcessCommandLine
| top 1 by TimeGenerated desc

DeviceProcessEvents
| where tolower(ProcessCommandLine) contains "vmw"
// look for common filter/list combos: grep/egrep or lsmod/cat /proc/modules
| where tolower(ProcessCommandLine) contains "grep" or tolower(ProcessCommandLine) contains "egrep" or tolower(ProcessCommandLine) contains "lsmod" or tolower(ProcessCommandLine) contains "/proc/modules" or tolower(FileName) contains "grep"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessId, ProcessCommandLine
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Devices=dcount(DeviceName) by ProcessCommandLine, FileName, InitiatingProcessAccountName
| order by LastSeen desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents
| extend cmd = coalesce(tostring(ProcessCommandLine), tostring(InitiatingProcessCommandLine), tostring(InitiatingProcessCommandLine))
| where isnotempty(cmd)
// Look for commands that inspect loaded kernel modules and search for "vmw" (case-insensitive)
| where tolower(cmd) contains "vmw" and (
    tolower(cmd) contains "lsmod" or
    tolower(cmd) contains "/proc/modules" or
    tolower(cmd) contains "cat /proc/modules"
    )
| project TimeGenerated, DeviceName, FileName, ProcessId, InitiatingProcessId = tostring(InitiatingProcessId), cmd
| summarize Occurrences = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cmd, DeviceName
| order by Occurrences desc, LastSeen desc
| limit 100

union DeviceProcessEvents, DeviceEvents
| extend CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| where isnotempty(CommandLine)
// look for cases where a grep/egrep was used to filter kernel modules for "vmw"
| where (tolower(CommandLine) contains "grep" or tolower(CommandLine) contains "egrep")
  and tolower(CommandLine) contains "vmw"
  and (tolower(CommandLine) contains "lsmod" or tolower(CommandLine) contains "/proc/modules")
| project TimeGenerated, DeviceName, FileName, ProcessId, AccountName, CommandLine
| sort by TimeGenerated desc
| take 100

DeviceProcessEvents
| extend CommandLine = iff(isnotempty(InitiatingProcessCommandLine), InitiatingProcessCommandLine, ProcessCommandLine) // prefer initiating process line, fallback to process line
| where CommandLine has "vmw" and CommandLine has "grep"
| project TimeGenerated, DeviceName, User = InitiatingProcessAccountName, CommandLine
| sort by TimeGenerated desc
| take 100

DeviceProcessEvents
| where ProcessCommandLine contains 'lsmod' and ProcessCommandLine contains 'vmw'
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| limit 10

DeviceProcessEvents
| where ProcessCommandLine has "lsmod" and ProcessCommandLine has "grep" and ProcessCommandLine has "vmw"
| project ProcessCommandLine
| distinct ProcessCommandLine
| limit 10

DeviceProcessEvents
| where ActionType == "ProcessCreated"
// Optionally filter only Linux devices, if needed, by joining with DeviceInfo:
// | join kind=innerunique (
//     DeviceInfo
//     | where OSPlatform == "Linux"
//     | project DeviceId
// ) on DeviceId
| where tolower(ProcessCommandLine) has_any ("lsmod","grep vmw","vmw.","cat /proc/modules")
   or tolower(InitiatingProcessCommandLine) has_any ("lsmod","grep vmw","vmw.","cat /proc/modules")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Substitute your own time picker in the portal – query is time-agnostic otherwise
DeviceProcessEvents
// (Optional) keep only Linux devices – comment out if not needed
| join kind=inner (
    DeviceInfo
    | where OSPlatform == "Linux"
    | project DeviceId
) on DeviceId
// Look for interactive inspection of the list of loaded kernel modules
// Typical ways are either “lsmod | grep vmw” or “cat /proc/modules | grep vmw”
| where ProcessCommandLine has "grep" and ProcessCommandLine has "vmw"
| where ProcessCommandLine has "lsmod" or ProcessCommandLine has "/proc/modules"
// Return the full command line that was executed
| summarize Executions = count() by DeviceName, AccountName, bin(TimeGenerated, 1h), FullCommand = tostring(ProcessCommandLine)
| project Time = TimeGenerated, DeviceName, AccountName, FullCommand, Executions
| order by Time desc

DeviceProcessEvents
| where ProcessCommandLine has "lsmod" and ProcessCommandLine has "grep" and ProcessCommandLine has "vmw"
| distinct ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine contains "lsmod" and ProcessCommandLine contains "grep" and ProcessCommandLine contains "vmw"
| distinct ProcessCommandLine
| project ProcessCommandLine

let LinuxDevices = DeviceInfo
| where OSPlatform has "Linux"
| distinct DeviceId;

DeviceProcessEvents
| where DeviceId in (LinuxDevices)
| where ProcessCommandLine has "lsmod" and ProcessCommandLine has "grep vmw"
| project FullCommand = ProcessCommandLine
| distinct FullCommand

// 1. Define the time range (the actual window will be set by the client)
let StartTime = startofday(ago(7d));
let EndTime = now();

// 2. Identify Linux devices
let LinuxDevices =
    DeviceInfo
    | where TimeGenerated between (StartTime .. EndTime)
    | where tolower(OSPlatform) has "linux"
    | distinct DeviceId;

// 3. Search for grep vmw in process command lines
union isfuzzy=true
    DeviceProcessEvents,
    DeviceEvents
| where TimeGenerated between (StartTime .. EndTime)
| where DeviceId in (LinuxDevices)
| extend FullCommand = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| where FullCommand has "grep" and FullCommand has "vmw"
| project TimeGenerated, DeviceName, FullCommand
| distinct FullCommand, DeviceName, TimeGenerated
| sort by TimeGenerated desc