Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where AccountName == "root" | where FileName in ("virt-what", "dmidecode", "systemd-detect-virt", "lshw") | project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName

DeviceProcessEvents | where ProcessCommandLine contains 'dmidecode' | project DeviceName, InitiatingProcessAccountName, ProcessCommandLine, ProcessCreationTime

DeviceProcessEvents | where FileName in~ ("dmidecode", "lshw", "lscpu", "lspci", "systemd-detect-virt", "virt-what", "dmesg", "hostnamectl") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName, ProcessTokenElevation | sort by TimeGenerated desc

// Query to detect if a privileged hardware interrogation utility is invoked union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceEvents | where ActionType == "ProcessCreated" // Focus on process creation events | where ProcessCommandLine contains "lscpu" // Looking for 'lscpu' command specifically // Optionally narrow to execute as root (UID 0) or Sudo users -- for example: // | where InitiatingProcessAccountName =~ "root" or InitiatingProcessCommandLine contains "/usr/bin/sudo" | project-reorder Timestamp, DeviceName, InitiatingProcessAccountUpn, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessParentCreationTime | summarize eventCount = count(), earliestEvent = min(Timestamp), latestEvent = max(Timestamp) by bin(Timestamp, 1d), DeviceName, InitiatingProcessAccountUpn, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessParentCreationTime | order by eventCount desc

DeviceProcessEvents | where FileName in ('dmidecode', 'lshw', 'systeminfo', 'biosdecode', 'xxd') | project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has_any ('lscpu', 'dmidecode', 'virt-what') or FileName has_any ('lscpu', 'dmidecode', 'virt-what') | project InitiatingProcessCommandLine, FileName, InitiatingProcessCreationTime, DeviceName, ProcessId

DeviceProcessEvents | join kind=inner DeviceInfo on DeviceId | where OSPlatform == 'Linux' | where ProcessCommandLine has 'dmidecode' or ProcessCommandLine has 'virt-what' or ProcessCommandLine has 'lscpu' or FileName has 'dmidecode' or FileName has 'virt-what' or FileName has 'lscpu' | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, ProcessId, DeviceId | order by TimeGenerated desc | limit 50

DeviceProcessEvents | join kind=inner (DeviceInfo | where OSPlatform == "Linux") on DeviceId | where ProcessCommandLine has_any ("dmidecode", "lshw", "lscpu", "virt-what") | summarize Utilities = make_set(FileName) by DeviceId | project Utilities

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "dmidecode" or ProcessCommandLine contains "dmidecode" | where DeviceId in (DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId) | project TimeGenerated, DeviceId, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, AccountDomain, LogonId | order by TimeGenerated desc

DeviceInfo | where OSPlatform == "Linux" | summarize arg_max(TimeGenerated, *) by DeviceId | join kind=inner ( DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "dmidecode" or ProcessCommandLine has "dmidecode" ) on DeviceId | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, FolderPath

DeviceProcessEvents | where ProcessCommandLine contains "dmidecode" or InitiatingProcessCommandLine contains "dmidecode" | project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains "dmidecode" or InitiatingProcessCommandLine contains "dmidecode" | project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, FileName | order by TimeGenerated desc

// Identify Linux devices let LinuxDevices = DeviceInfo | where OSPlatform has "Linux" or OSDistribution has "linux" | distinct DeviceId; // Find dmidecode invocations on those Linux devices DeviceProcessEvents | where DeviceId in (LinuxDevices) and (FileName == "dmidecode" or ProcessCommandLine has "dmidecode") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName | sort by TimeGenerated desc

let LinuxDevices = DeviceInfo | where OSPlatform contains "linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ProcessCommandLine contains "dmidecode" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine