Photo ZIP Lure Leads to Persistent Node JS Access

let target_user="denis@example.com";
EmailUrlInfo
| where Timestamp >= ago(14d)
| where Url has_any ("calendly.com/url?q=","share.google/","photo-")
| join kind=inner (
    EmailEvents
    | where Timestamp >= ago(14d)
    | where RecipientEmailAddress =~ target_user
    | project NetworkMessageId, MailTime=Timestamp, SenderFromAddress, SenderMailFromDomain,
              SenderDisplayName, RecipientEmailAddress, Subject, DeliveryAction,
              DeliveryLocation, ThreatTypes, AuthenticationDetails
) on NetworkMessageId
| where Url contains "calendly.com/url?q="
    or Url contains "share.google/"
    or (Url contains "photo-" and Url contains ".cfd")
| project MailTime,NetworkMessageId,SenderFromAddress,SenderMailFromDomain,SenderDisplayName,
          RecipientEmailAddress,Subject,Url,DeliveryAction,AuthenticationDetails
| order by MailTime asc

(
  index=<email_index> sourcetype=<email_events_sourcetype> earliest=-14d
)
OR
(
  index=<email_url_index> sourcetype=<email_url_info_sourcetype> earliest=-14d
)
| eval recipient=lower(coalesce(recipient,RecipientEmailAddress)),
       message_id=coalesce(message_id,NetworkMessageId),
       url=coalesce(url,Url),
       sender=lower(coalesce(sender,SenderFromAddress))
| where recipient="denis@example.com"
| eventstats values(sender) as senders values(Subject) as subjects values(AuthenticationDetails) as auth by message_id recipient
| where isnotnull(url) AND (
    like(lower(url),"%calendly.com/url?q=%")
    OR like(lower(url),"%share.google/%")
    OR (like(lower(url),"%photo-%") AND like(lower(url),"%.cfd%"))
)
| table _time recipient message_id senders subjects url auth
| sort 0 _time

let target_device="<DEVICE_NAME>";
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where DeviceName =~ target_device
| where
    (ProcessCommandLine has ".png.lnk" and ProcessCommandLine has_any ("IMG-","PHOTO-"))
    or
    (FileName in~ ("powershell.exe","pwsh.exe") and
     ProcessCommandLine has_any ("Invoke-WebRequest"," iwr ","iwr ") and
     ProcessCommandLine has ".ps1")
| project Timestamp,DeviceName,AccountUpn,FileName,FolderPath,ProcessCommandLine,SHA1,SHA256,
          InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp asc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-14d
| eval device=coalesce(device,DeviceName,host),
       process_name=lower(coalesce(process_name,FileName)),
       cmd=coalesce(process_command_line,ProcessCommandLine)
| where device="<DEVICE_NAME>" AND (
    (like(lower(cmd),"%.png.lnk%") AND (like(cmd,"%IMG-%") OR like(cmd,"%PHOTO-%")))
    OR
    (process_name IN ("powershell.exe","pwsh.exe") AND
     (like(lower(cmd),"%invoke-webrequest%") OR like(lower(cmd),"%iwr %")) AND
     like(lower(cmd),"%.ps1%"))
)
| table _time device process_name cmd InitiatingProcessFileName InitiatingProcessCommandLine SHA1 SHA256
| sort 0 _time

let target_device="<DEVICE_NAME>";
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where DeviceName =~ target_device
| where FileName =~ "node.exe"
| where FolderPath has @"\AppData\Local\Nodejs\"
| where ProcessCommandLine has ".js"
| project Timestamp,DeviceName,AccountUpn,FileName,FolderPath,ProcessCommandLine,ProcessUniqueId,
          SHA1,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp asc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-14d
| eval device=coalesce(device,DeviceName,host),
       process_name=lower(coalesce(process_name,FileName)),
       process_path=lower(coalesce(process_path,FolderPath)),
       cmd=coalesce(process_command_line,ProcessCommandLine)
| where device="<DEVICE_NAME>" AND process_name="node.exe"
    AND like(process_path,"%\\appdata\\local\\nodejs\\%")
    AND like(lower(cmd),"%.js%")
| table _time device process_name process_path cmd SHA1 SHA256 InitiatingProcessFileName InitiatingProcessCommandLine
| sort 0 _time

let target_device="<DEVICE_NAME>";
let exclusions =
    DeviceProcessEvents
    | where Timestamp >= ago(14d)
    | where DeviceName =~ target_device
    | where FileName in~ ("powershell.exe","pwsh.exe")
    | where ProcessCommandLine has "Add-MpPreference" and ProcessCommandLine has "-ExclusionProcess"
    | project DeviceId,DeviceName,ExclusionTime=Timestamp,ExclusionCmd=ProcessCommandLine;
let tempExecs =
    DeviceProcessEvents
    | where Timestamp >= ago(14d)
    | where DeviceName =~ target_device
    | where FolderPath has @"\AppData\Local\Temp\" and FileName endswith ".exe"
    | project DeviceId,TempExecTime=Timestamp,TempFile=FileName,TempPath=FolderPath,TempCmd=ProcessCommandLine;
exclusions
| join kind=inner tempExecs on DeviceId
| where TempExecTime between (ExclusionTime .. ExclusionTime + 30m)
| project DeviceName,ExclusionTime,ExclusionCmd,TempExecTime,TempFile,TempPath,TempCmd
| order by ExclusionTime asc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-14d
| eval device=coalesce(device,DeviceName,host),
       process_name=lower(coalesce(process_name,FileName)),
       process_path=lower(coalesce(process_path,FolderPath)),
       cmd=coalesce(process_command_line,ProcessCommandLine),
       event_type=case(
         process_name IN ("powershell.exe","pwsh.exe") AND like(lower(cmd),"%add-mppreference%") AND like(lower(cmd),"%-exclusionprocess%"),"exclusion",
         like(process_path,"%\\appdata\\local\\temp\\%") AND like(process_name,"%.exe"),"temp_exec",
         true(),"other")
| where device="<DEVICE_NAME>" AND event_type!="other"
| sort 0 device _time
| streamstats current=f last(eval(if(event_type="exclusion",_time,null()))) as exclusion_time by device
| where event_type="temp_exec" AND isnotnull(exclusion_time) AND _time<=exclusion_time+1800
| table _time exclusion_time device process_name process_path cmd
| sort 0 exclusion_time

let target_device="<DEVICE_NAME>";
DeviceRegistryEvents
| where Timestamp >= ago(14d)
| where DeviceName =~ target_device
| where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Run"
    or RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\RunOnce"
| where RegistryValueData has_any (@"\AppData\Local\Nodejs\",@"\ProgramData\")
| extend PersistenceKind=case(
    RegistryKey endswith @"\RunOnce","RunOnce",
    RegistryKey endswith @"\Run","Run","Other")
| project Timestamp,DeviceName,ActionType,PersistenceKind,RegistryKey,RegistryValueName,
          RegistryValueData,PreviousRegistryValueData,InitiatingProcessFileName,
          InitiatingProcessCommandLine,InitiatingProcessAccountUpn
| order by Timestamp asc

index=<endpoint_registry_index> sourcetype=<registry_events_sourcetype> earliest=-14d
| eval device=coalesce(device,DeviceName,host),
       registry_key=coalesce(registry_key,RegistryKey),
       value_data=coalesce(value_data,RegistryValueData),
       persistence_kind=case(
         like(lower(registry_key),"%\\runonce"),"RunOnce",
         like(lower(registry_key),"%\\run"),"Run",
         true(),"Other")
| where device="<DEVICE_NAME>"
  AND (like(lower(registry_key),"%\\currentversion\\run") OR like(lower(registry_key),"%\\currentversion\\runonce"))
  AND (like(lower(value_data),"%\\appdata\\local\\nodejs\\%") OR like(lower(value_data),"%\\programdata\\%"))
| table _time device persistence_kind registry_key RegistryValueName value_data InitiatingProcessFileName InitiatingProcessCommandLine
| sort 0 _time

let target_device="<DEVICE_NAME>";
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where DeviceName =~ target_device
| where RemotePort in (8443,8445,8453,5555,56001,56002,56003)
| where InitiatingProcessFileName =~ "node.exe"
    or InitiatingProcessFolderPath has @"\AppData\Local\Temp\"
    or InitiatingProcessFolderPath has @"\AppData\Local\Nodejs\"
    or InitiatingProcessFolderPath has @"\ProgramData\"
| project Timestamp,DeviceName,RemoteUrl,RemoteIP,RemotePort,Protocol,
          InitiatingProcessFileName,InitiatingProcessFolderPath,InitiatingProcessCommandLine
| order by Timestamp asc

index=<endpoint_network_index> sourcetype=<endpoint_network_events_sourcetype> earliest=-14d
| eval device=coalesce(device,DeviceName,host),
       remote_port=coalesce(remote_port,RemotePort,dest_port),
       process_name=lower(coalesce(process_name,InitiatingProcessFileName)),
       process_path=lower(coalesce(process_path,InitiatingProcessFolderPath))
| where device="<DEVICE_NAME>" AND remote_port IN (8443,8445,8453,5555,56001,56002,56003)
  AND (process_name="node.exe" OR like(process_path,"%\\appdata\\local\\%") OR like(process_path,"%\\programdata\\%"))
| table _time device process_name process_path RemoteIP RemoteUrl remote_port
| sort 0 _time