Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine contains "lsmod" and ProcessCommandLine contains "vmw" | distinct ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains 'vmw' | summarize Count=count() by ProcessCommandLine | project ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has 'lsmod' and ProcessCommandLine has 'vmw' and (ProcessCommandLine contains 'grep' or ProcessCommandLine contains 'awk') | summarize count() by ProcessCommandLine | order by count_ desc | project ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has_any ('lsmod', 'cat /proc/modules') and ProcessCommandLine has 'grep vmw' | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | distinct ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains "lsmod" and ProcessCommandLine contains "vmw" | distinct ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains 'vmw' | where ProcessCommandLine matches regex '(grep|cat|awk)' // Filtering commands likely used for filtering kernel modules | project TimeGenerated, ProcessCommandLine | top 1 by TimeGenerated desc

DeviceProcessEvents | where tolower(ProcessCommandLine) contains "vmw" // look for common filter/list combos: grep/egrep or lsmod/cat /proc/modules | where tolower(ProcessCommandLine) contains "grep" or tolower(ProcessCommandLine) contains "egrep" or tolower(ProcessCommandLine) contains "lsmod" or tolower(ProcessCommandLine) contains "/proc/modules" or tolower(FileName) contains "grep" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessId, ProcessCommandLine | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Devices=dcount(DeviceName) by ProcessCommandLine, FileName, InitiatingProcessAccountName | order by LastSeen desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents | extend cmd = coalesce(tostring(ProcessCommandLine), tostring(InitiatingProcessCommandLine), tostring(InitiatingProcessCommandLine)) | where isnotempty(cmd) // Look for commands that inspect loaded kernel modules and search for "vmw" (case-insensitive) | where tolower(cmd) contains "vmw" and ( tolower(cmd) contains "lsmod" or tolower(cmd) contains "/proc/modules" or tolower(cmd) contains "cat /proc/modules" ) | project TimeGenerated, DeviceName, FileName, ProcessId, InitiatingProcessId = tostring(InitiatingProcessId), cmd | summarize Occurrences = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cmd, DeviceName | order by Occurrences desc, LastSeen desc | limit 100

union DeviceProcessEvents, DeviceEvents | extend CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | where isnotempty(CommandLine) // look for cases where a grep/egrep was used to filter kernel modules for "vmw" | where (tolower(CommandLine) contains "grep" or tolower(CommandLine) contains "egrep") and tolower(CommandLine) contains "vmw" and (tolower(CommandLine) contains "lsmod" or tolower(CommandLine) contains "/proc/modules") | project TimeGenerated, DeviceName, FileName, ProcessId, AccountName, CommandLine | sort by TimeGenerated desc | take 100

DeviceProcessEvents | extend CommandLine = iff(isnotempty(InitiatingProcessCommandLine), InitiatingProcessCommandLine, ProcessCommandLine) // prefer initiating process line, fallback to process line | where CommandLine has "vmw" and CommandLine has "grep" | project TimeGenerated, DeviceName, User = InitiatingProcessAccountName, CommandLine | sort by TimeGenerated desc | take 100

DeviceProcessEvents | where ProcessCommandLine contains 'lsmod' and ProcessCommandLine contains 'vmw' | project Timestamp, DeviceName, AccountName, ProcessCommandLine | limit 10

DeviceProcessEvents | where ProcessCommandLine has "lsmod" and ProcessCommandLine has "grep" and ProcessCommandLine has "vmw" | project ProcessCommandLine | distinct ProcessCommandLine | limit 10

DeviceProcessEvents | where ActionType == "ProcessCreated" // Optionally filter only Linux devices, if needed, by joining with DeviceInfo: // | join kind=innerunique ( // DeviceInfo // | where OSPlatform == "Linux" // | project DeviceId // ) on DeviceId | where tolower(ProcessCommandLine) has_any ("lsmod","grep vmw","vmw.","cat /proc/modules") or tolower(InitiatingProcessCommandLine) has_any ("lsmod","grep vmw","vmw.","cat /proc/modules") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

// Substitute your own time picker in the portal – query is time-agnostic otherwise DeviceProcessEvents // (Optional) keep only Linux devices – comment out if not needed | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | project DeviceId ) on DeviceId // Look for interactive inspection of the list of loaded kernel modules // Typical ways are either “lsmod | grep vmw” or “cat /proc/modules | grep vmw” | where ProcessCommandLine has "grep" and ProcessCommandLine has "vmw" | where ProcessCommandLine has "lsmod" or ProcessCommandLine has "/proc/modules" // Return the full command line that was executed | summarize Executions = count() by DeviceName, AccountName, bin(TimeGenerated, 1h), FullCommand = tostring(ProcessCommandLine) | project Time = TimeGenerated, DeviceName, AccountName, FullCommand, Executions | order by Time desc

DeviceProcessEvents | where ProcessCommandLine has "lsmod" and ProcessCommandLine has "grep" and ProcessCommandLine has "vmw" | distinct ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains "lsmod" and ProcessCommandLine contains "grep" and ProcessCommandLine contains "vmw" | distinct ProcessCommandLine | project ProcessCommandLine

let LinuxDevices = DeviceInfo | where OSPlatform has "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ProcessCommandLine has "lsmod" and ProcessCommandLine has "grep vmw" | project FullCommand = ProcessCommandLine | distinct FullCommand

// 1. Define the time range (the actual window will be set by the client) let StartTime = startofday(ago(7d)); let EndTime = now(); // 2. Identify Linux devices let LinuxDevices = DeviceInfo | where TimeGenerated between (StartTime .. EndTime) | where tolower(OSPlatform) has "linux" | distinct DeviceId; // 3. Search for grep vmw in process command lines union isfuzzy=true DeviceProcessEvents, DeviceEvents | where TimeGenerated between (StartTime .. EndTime) | where DeviceId in (LinuxDevices) | extend FullCommand = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | where FullCommand has "grep" and FullCommand has "vmw" | project TimeGenerated, DeviceName, FullCommand | distinct FullCommand, DeviceName, TimeGenerated | sort by TimeGenerated desc