Question Analysis

DeviceProcessEvents | where ProcessCommandLine contains "/etc/security/" | project Timestamp, DeviceName, ProcessCommandLine

DeviceProcessEvents | where InitiatingProcessCommandLine has '/etc/security/' or FileName has '/etc/security/' | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FileName

DeviceProcessEvents | where ProcessCommandLine contains "/etc/security/" | extend ConfigFileAccessed = extract(@"/etc/security/([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, ConfigFileAccessed | order by TimeGenerated desc

let linux_cmds = @"(?i)\b(cat|less|more|tail|head|vi|vim|nano|sed|awk|grep|strings|stat)\b"; let etc_prefix = "/etc/security"; union isfuzzy=true ( DeviceProcessEvents | project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId, InitiatingProcessFileName, FileName, FolderPath, SourceSystem ), ( DeviceEvents | project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId, InitiatingProcessFileName, FileName, FolderPath, SourceSystem ), ( DeviceFileEvents | project TimeGenerated, DeviceId, DeviceName, AccountName = RequestAccountName, InitiatingProcessAccountName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessCommandLine, ProcessId = InitiatingProcessId, InitiatingProcessId, InitiatingProcessFileName, FileName, FolderPath, SourceSystem ) | extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, "") // Keep events that reference /etc/security in cmdline or file fields | where CmdLine contains etc_prefix or (isnotempty(FileName) and FileName startswith etc_prefix) or (isnotempty(FolderPath) and FolderPath startswith etc_prefix) // Extract exact /etc/security paths from command lines (handles quoted paths). The pattern excludes whitespace and quotes inside the path token. | extend MatchedPaths = extract_all('(/etc/security(?:/[^ \t\r\n''"]*)*)', CmdLine) | mv-expand MatchedPaths to typeof(string) | extend MatchedPaths = trim('''"', MatchedPaths) | where isnotempty(MatchedPaths) // Prefer likely inspection commands or shells/editors, but allow direct file events too | where CmdLine matches regex(linux_cmds) or tostring(InitiatingProcessFileName) in~ ("bash","sh","sshd","sudo","su","vi","vim","nano","less","more") or FileName startswith etc_prefix // Enrich with latest DeviceInfo per device (best-effort) | join kind=leftouter ( DeviceInfo | summarize arg_max(TimeGenerated, *) by DeviceId | project DeviceId, OSDistribution, OSVersion, DeviceNameInfo = DeviceName ) on DeviceId // Summarize by device and the exact matched path | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), DeviceNames = make_set(coalesce(DeviceName, DeviceNameInfo), 5), Accounts = make_set(AccountName, 5), InitiatingAccounts = make_set(InitiatingProcessAccountName,5), InitiatingProcesses = make_set(InitiatingProcessFileName,5), ProcessIds = make_set(ProcessId,5), CmdLines = make_set(CmdLine,20) by DeviceId, MatchedFile = MatchedPaths, OSDistribution, OSVersion | project DeviceId, DeviceName = tostring(DeviceNames[0]), MatchedFile, Count, FirstSeen, LastSeen, Accounts, InitiatingAccounts, InitiatingProcesses, ProcessIds, CmdLines, OSDistribution, OSVersion | order by FirstSeen desc

DeviceProcessEvents | join kind=leftouter ( DeviceInfo | where OSPlatform contains "Linux" ) on DeviceId | where ProcessCommandLine contains "/etc/security" | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName, OSPlatform | order by Timestamp desc

DeviceProcessEvents | where InitiatingProcessCommandLine contains "/etc/security" | extend AccessedFile = extract(@"(/etc/security/[^ ]+)", 1, InitiatingProcessCommandLine) | where isnotempty(AccessedFile) | distinct AccessedFile | order by AccessedFile asc

union DeviceProcessEvents, DeviceFileEvents | where FolderPath contains "/etc/security" or ProcessCommandLine contains "/etc/security" | where ActionType in ("FileAccessed", "FileOpened", "FileRead", "FileModified", "ProcessCreated", "ProcessLaunched") | project TimeGenerated, DeviceName, FolderPath, FileName, ProcessCommandLine, ActionType | order by TimeGenerated desc

// Search across file and process event tables for references to files under /etc/security union DeviceFileEvents, DeviceProcessEvents | where FolderPath contains "/etc/security" or ProcessCommandLine has "/etc/security" or InitiatingProcessCommandLine has "/etc/security" | project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine contains "/etc/security" | extend InspectedFile = tostring(extract(@"(/etc/security/\S+)", 1, InitiatingProcessCommandLine)) | where isnotempty(InspectedFile) | distinct TimeGenerated, InspectedFile, InitiatingProcessCommandLine | order by TimeGenerated desc

union isfuzzy=true ( DeviceFileEvents | where FolderPath startswith "/etc/security" | extend FullPath = strcat(FolderPath, "/", FileName) | project Timestamp = TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, CommandLine = InitiatingProcessCommandLine, FullPath ), ( DeviceProcessEvents | where ProcessCommandLine contains "/etc/security/" | extend FullPath = extract(@"(/etc/security/\S+)", 1, ProcessCommandLine) | project Timestamp = ProcessCreationTime, DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, CommandLine = ProcessCommandLine, FullPath ) | sort by Timestamp desc

DeviceProcessEvents | where FileName in ("cat","less","more","tail","head","grep","vi","vim","nano","sed","awk") | where ProcessCommandLine contains "/etc/security/" | extend ConfigFile = extract(@"(/etc/security/\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName = AccountUpn, ShellCommand = FileName, ProcessCommandLine, ConfigFile | order by TimeGenerated desc