Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has_any ("locale", "localectl", "env ") or ProcessCommandLine contains " grep locale" | project Timestamp, DeviceName, FileName, ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains 'locale' | project ProcessId, FileName, ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has 'locale' | project DeviceName, FileName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where FileName in~ ('locale', 'localectl') or ProcessCommandLine has_any ('locale', 'localectl', '/etc/locale.conf') | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath | order by TimeGenerated desc

DeviceProcessEvents | where TimeGenerated > ago(30d) | where ProcessCommandLine has_any ("locale", "localectl", "/etc/default/locale", "/etc/locale.conf", "/etc/sysconfig/i18n") | summarize count() by FolderPath, ProcessCommandLine | order by count_ desc | extend MITRE_Technique = "T1033" | extend MITRE_TechniqueName = "System Owner/User Discovery" | extend MITRE_IDs_URL = "https://attack.mitre.org/techniques/T1033/" | extend MITRE_Technique_URL = "https://attack.mitre.org/techniques/T1033/"

union DeviceProcessEvents, DeviceEvents | where ProcessCommandLine has_any ("locale", "localectl", "echo $LANG") or ActionType has_any ("locale", "localectl", "echo $LANG") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, ActionType | sort by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains 'localectl' or ProcessCommandLine contains 'locale' or ProcessCommandLine contains 'echo $LANG' or ProcessCommandLine contains 'echo $LC_ALL' | project InitiatingProcessFileName, ProcessCommandLine, TimeGenerated, DeviceName

DeviceProcessEvents | where InitiatingProcessCommandLine contains "locale" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessCreationTime

let linuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId, DeviceName; let procLocale = DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner (linuxDevices) on DeviceId | extend Cmd = tostring(ProcessCommandLine) | where FileName in~ ("localectl", "locale") or Cmd matches regex @"\blocalectl\s+(?:status|show|list-locales)\b" or Cmd matches regex @"\blocale(\s+(-{1,2}\w+|\w+)*)?\b" or (FileName in~ ("printenv","env") and Cmd matches regex @"\b(?:LANG|LC_[A-Z_]+)\b") or (FileName in~ ("cat","grep","awk","sed") and Cmd matches regex @"\b(?:/etc/(?:locale\.conf|default/locale|environment)|(?:LANG|LC_[A-Z_]+))\b") | extend Executable = coalesce(extract(@"^(?:sudo\s+(?:-[^\s]+\s+)*)?(\S+)", 1, Cmd), FolderPath, FileName) | project TimeGenerated, DeviceName, AccountName, Executable, CommandLine=Cmd, SourceTable="DeviceProcessEvents"; let linuxHosts = linuxDevices | project DeviceName; let syslogLocale = Syslog | where SyslogMessage has "COMMAND=" | extend Cmd = extract(@"COMMAND=([^\r\n]+)", 1, SyslogMessage) | where isnotempty(Cmd) | where Cmd matches regex @"\b(localectl|locale)\b" or Cmd matches regex @"\b(?:printenv|env)\b.*\b(?:LANG|LC_[A-Z_]+)\b" or Cmd matches regex @"\b(?:cat|grep|awk|sed)\b.*\b(?:/etc/(?:locale\.conf|default/locale|environment)|(?:LANG|LC_[A-Z_]+))\b" | extend Executable = extract(@"^(?:sudo\s+(?:-[^\s]+\s+)*)?(\S+)", 1, Cmd) | extend DeviceName = coalesce(column_ifexists("HostName",""), column_ifexists("Computer","")) | where isnotempty(DeviceName) | join kind=inner (linuxHosts) on DeviceName | extend AccountName = extract(@"sudo:\s*([^:]+)\s*:", 1, SyslogMessage) | project TimeGenerated, DeviceName, AccountName, Executable, CommandLine=Cmd, SourceTable="Syslog"; union procLocale, syslogLocale | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count() by DeviceName, AccountName, Executable, CommandLine, SourceTable | order by LastSeen desc

// Identify executables used to output system locale information on Linux // Adjust the time range as needed (caller may override) let TimeWindow = ago(30d); let localeRegex = @"\b(locale|localectl|lang|locale\s+-a)\b|cat\s+/etc/(default/)?locale|grep\s+LANG|printenv\s+LANG|env\s*\|\s*grep\s+LANG"; // Search DeviceProcessEvents for process command lines let proc = DeviceProcessEvents | where TimeGenerated >= TimeWindow and isnotempty(ProcessCommandLine) | extend cmd = tostring(ProcessCommandLine), exePath = coalesce(tolower(FileName), tostring(split(tolower(ProcessCommandLine), ' ')[0])) | where cmd matches regex localeRegex | project TimeGenerated, SourceTable = 'DeviceProcessEvents', DeviceName, AccountName, ProcessId, exePath, cmd, InitiatingProcessFileName, InitiatingProcessCommandLine; // Search DeviceEvents let dev = DeviceEvents | where TimeGenerated >= TimeWindow | extend cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, tostring(AdditionalFields)), exePath = coalesce(tolower(FileName), tostring(split(tolower(ProcessCommandLine), ' ')[0])) | where isnotempty(cmd) and tostring(cmd) matches regex localeRegex | project TimeGenerated, SourceTable = 'DeviceEvents', DeviceName, AccountName, ProcessId = tostring(ProcessId), exePath, cmd; // Search DeviceFileEvents let file = DeviceFileEvents | where TimeGenerated >= TimeWindow | extend cmd = coalesce(InitiatingProcessCommandLine, FileName, tostring(AdditionalFields)), exePath = coalesce(tolower(FileName), tostring(split(tolower(InitiatingProcessCommandLine), ' ')[0])) | where isnotempty(cmd) and tostring(cmd) matches regex localeRegex | project TimeGenerated, SourceTable = 'DeviceFileEvents', DeviceName, AccountName = InitiatingProcessAccountName, ProcessId = tostring(InitiatingProcessId), exePath, cmd; // Combine and normalize executable name union isfuzzy=true proc, dev, file | extend exe = replace(".*/", "", tostring(exePath)) | summarize Count = count(), Devices = dcount(DeviceName), Latest = max(TimeGenerated), Samples = make_set(cmd, 10) by exe | where exe != '' | order by Latest desc, Count desc | top 100 by Latest

// Identify executables that were run to output system locale information on Linux // Adjust time range using 'where Timestamp between (start .. end)' let locale_terms = dynamic([" locale ", "localectl", "/etc/locale.conf", "LANG=", "grep LANG", "/etc/default/locale", "update-locale", "/etc/locale.gen"]); // Search process events (Linux) for locale-related commands let procs = DeviceProcessEvents | where isnotempty(ProcessCommandLine) or isnotempty(FileName) // Optional: filter by OSPlatform if available (some tenants populate OSPlatform in DeviceInfo) // | where tostring(OSPlatform) has "Linux" | where ( ProcessCommandLine has "locale" or ProcessCommandLine has "localectl" or ProcessCommandLine has "/etc/locale.conf" or ProcessCommandLine contains "LANG=" or ProcessCommandLine has "grep LANG" or ProcessCommandLine has "cat /etc/default/locale" or ProcessCommandLine has "update-locale" or ProcessCommandLine has "/etc/locale.gen" ) | extend Executable = coalesce(FileName, tostring(split(ProcessCommandLine," ")[0]), InitiatingProcessFileName, InitiatingProcessCommandLine) | project Timestamp, DeviceName, AccountName, ProcessId, ParentProcessId=InitiatingProcessParentId, Executable, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFileName, FileName, SourceTable = "DeviceProcessEvents"; // Search DeviceEvents (may include syslog/shell output) for references to locale files/variables let events = DeviceEvents | where isnotempty(AdditionalFields) or isnotempty(ProcessCommandLine) or isnotempty(FileName) | where ( tostring(AdditionalFields) contains "locale" or tostring(AdditionalFields) contains "LANG" or ProcessCommandLine has "locale" or ProcessCommandLine has "localectl" or FileName has "/etc/locale.conf" or ProcessCommandLine has "cat /etc/default/locale" or ProcessCommandLine has "grep LANG" ) | extend Executable = coalesce(FileName, tostring(split(ProcessCommandLine," ")[0]), InitiatingProcessFileName, InitiatingProcessCommandLine) | project Timestamp, DeviceName, AccountName, ProcessId=InitiatingProcessId, ParentProcessId=InitiatingProcessParentId, Executable, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFileName, FileName, SourceTable = "DeviceEvents"; // Combine and present results; caller should apply a time filter externally via the function time range procs | union events | sort by Timestamp desc | summarize count_ct = count(), any_Timestamp = any(Timestamp), any_Device = any(DeviceName), any_Account = any(AccountName), Executables = make_set(Executable, 25), Cmdlines = make_set(ProcessCommandLine, 25) by bin(Timestamp, 1h) | order by any_Timestamp desc | limit 200

DeviceProcessEvents | where ProcessCommandLine contains "locale" | project FileName, ProcessCommandLine, Timestamp | order by Timestamp desc

DeviceInfo | where OSPlatform == "Linux" | project DeviceId | join kind=inner ( DeviceProcessEvents | where ActionType == "ProcessCreated" | where (FileName in~ ("locale", "localectl", "cat") or (FileName == "env" and ProcessCommandLine has "LANG=")) | where ProcessCommandLine has_any ("locale", "localectl", "LANG=", "/etc/locale.conf") | project TimeGenerated, DeviceId, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath ) on DeviceId

DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId | join kind=inner ( DeviceProcessEvents | where FileName in~ ("locale", "localectl") or ProcessCommandLine has_any ("locale", "localectl") ) on DeviceId | project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine

// Step 1 – Identify Linux devices let linuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | project DeviceId, DeviceName; // Step 2 – Find processes that output locale information linuxDevices | join kind=inner ( DeviceProcessEvents | where FileName in~ ("locale", "localectl") or ProcessCommandLine has_cs " locale" // avoid matching “localepurge” etc. | project DeviceId, TimeGenerated, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine ) on DeviceId | project TimeGenerated, DeviceName, Executable = strcat(FolderPath, "/", FileName), CommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName, ParentCommandLine = InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains "locale" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine | top 100 by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine contains "locale" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime | sort by ProcessCreationTime desc