New User-Space Node JS with Run-Key Persistence

let target_device="<DEVICE_NAME>";
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where DeviceName =~ target_device
| where
    (ProcessCommandLine has ".png.lnk" and ProcessCommandLine has_any ("IMG-","PHOTO-"))
    or
    (FileName in~ ("powershell.exe","pwsh.exe") and
     ProcessCommandLine has_any ("Invoke-WebRequest"," iwr ","iwr ") and
     ProcessCommandLine has ".ps1")
| project Timestamp,DeviceName,AccountUpn,FileName,FolderPath,ProcessCommandLine,
          SHA1,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp asc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-7d
| eval device=coalesce(device,DeviceName,host),
       process_name=lower(coalesce(process_name,FileName)),
       cmd=coalesce(process_command_line,ProcessCommandLine)
| where device="<DEVICE_NAME>" AND (
    (like(lower(cmd),"%.png.lnk%") AND (like(cmd,"%IMG-%") OR like(cmd,"%PHOTO-%")))
    OR
    (process_name IN ("powershell.exe","pwsh.exe") AND
     (like(lower(cmd),"%invoke-webrequest%") OR like(lower(cmd),"%iwr %")) AND
     like(lower(cmd),"%.ps1%")))
| table _time device process_name cmd InitiatingProcessFileName InitiatingProcessCommandLine SHA1 SHA256
| sort 0 _time

let target_device="<DEVICE_NAME>";
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where DeviceName =~ target_device
| where FileName in~ ("csc.exe","cvtres.exe")
| where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe")
    or InitiatingProcessFolderPath has @"\AppData\Local\Temp\"
| project Timestamp,DeviceName,FileName,FolderPath,ProcessCommandLine,
          InitiatingProcessFileName,InitiatingProcessFolderPath,InitiatingProcessCommandLine
| order by Timestamp asc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-7d
| eval device=coalesce(device,DeviceName,host),
       process_name=lower(coalesce(process_name,FileName)),
       parent_name=lower(coalesce(parent_name,InitiatingProcessFileName)),
       parent_path=lower(coalesce(parent_path,InitiatingProcessFolderPath))
| where device="<DEVICE_NAME>" AND process_name IN ("csc.exe","cvtres.exe")
    AND (parent_name IN ("powershell.exe","pwsh.exe") OR like(parent_path,"%\\appdata\\local\\temp\\%"))
| table _time device process_name ProcessCommandLine parent_name parent_path InitiatingProcessCommandLine
| sort 0 _time

let target_device="<DEVICE_NAME>";
let e=DeviceProcessEvents
| where Timestamp >= ago(7d) and DeviceName =~ target_device
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has "Add-MpPreference" and ProcessCommandLine has "-ExclusionProcess"
| project DeviceId,ExclusionTime=Timestamp,ExclusionCmd=ProcessCommandLine;
let x=DeviceProcessEvents
| where Timestamp >= ago(7d) and DeviceName =~ target_device
| where FolderPath has @"\AppData\Local\Temp\" and FileName endswith ".exe"
| project DeviceId,ExecTime=Timestamp,FileName,FolderPath,ProcessCommandLine;
e
| join kind=inner x on DeviceId
| where ExecTime between (ExclusionTime .. ExclusionTime+30m)
| order by ExclusionTime asc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-7d
| eval device=coalesce(device,DeviceName,host),
       process_name=lower(coalesce(process_name,FileName)),
       process_path=lower(coalesce(process_path,FolderPath)),
       cmd=coalesce(process_command_line,ProcessCommandLine),
       event_type=case(
         process_name IN ("powershell.exe","pwsh.exe") AND like(lower(cmd),"%add-mppreference%") AND like(lower(cmd),"%-exclusionprocess%"),"exclusion",
         like(process_path,"%\\appdata\\local\\temp\\%") AND like(process_name,"%.exe"),"temp_exec",
         true(),"other")
| where device="<DEVICE_NAME>" AND event_type!="other"
| sort 0 device _time
| streamstats current=f last(eval(if(event_type="exclusion",_time,null()))) as exclusion_time by device
| where event_type="temp_exec" AND isnotnull(exclusion_time) AND _time<=exclusion_time+1800
| table _time exclusion_time device process_name process_path cmd

let target_device="<DEVICE_NAME>";
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where DeviceName =~ target_device
| where RemotePort in (8443,8445,8453,5555,56001,56002,56003)
| where InitiatingProcessFileName =~ "node.exe"
    or InitiatingProcessFolderPath has @"\AppData\Local\Temp\"
    or InitiatingProcessFolderPath has @"\AppData\Local\Nodejs\"
    or InitiatingProcessFolderPath has @"\ProgramData\"
| project Timestamp,DeviceName,RemoteUrl,RemoteIP,RemotePort,Protocol,
          InitiatingProcessFileName,InitiatingProcessFolderPath,InitiatingProcessCommandLine
| order by Timestamp asc

index=<endpoint_network_index> sourcetype=<endpoint_network_events_sourcetype> earliest=-7d
| eval device=coalesce(device,DeviceName,host),
       remote_port=coalesce(remote_port,RemotePort,dest_port),
       process_name=lower(coalesce(process_name,InitiatingProcessFileName)),
       process_path=lower(coalesce(process_path,InitiatingProcessFolderPath))
| where device="<DEVICE_NAME>" AND remote_port IN (8443,8445,8453,5555,56001,56002,56003)
    AND (process_name="node.exe" OR like(process_path,"%\\appdata\\local\\%") OR like(process_path,"%\\programdata\\%"))
| table _time device process_name process_path RemoteIP RemoteUrl remote_port
| sort 0 _time