Hunt for Helpdesk Impersonation to Remote Access and Exfiltration

let correlation_window = 30m;
let organization_domains = dynamic(["example.com"]);
let support_terms = dynamic([
    "helpdesk",
    "help desk",
    "it support",
    "microsoft support",
    "security",
    "service desk"
]);

let teams =
    MessageEvents
    | where Timestamp >= ago(1d)
    | extend Recipient=parse_json(RecipientDetails)
    | mv-expand Recipient
    | extend
        VictimAccountObjectId=tostring(Recipient.RecipientObjectId),
        VictimRecipientDisplayName=tostring(Recipient.RecipientDisplayName),
        SenderDomain=tolower(extract(@"@([^>]+)$", 1, SenderEmailAddress))
    | where isnotempty(VictimAccountObjectId)
    | where isnotempty(SenderDomain) and SenderDomain !in~ (organization_domains)
    | where SenderDisplayName has_any (support_terms)
    | project
        TeamTime=Timestamp,
        SenderEmailAddress,
        SenderDisplayName,
        SenderDomain,
        VictimRecipientDisplayName,
        VictimAccountObjectId,
        NetworkMessageId;

let remote_assist =
    DeviceProcessEvents
    | where Timestamp >= ago(1d)
    | where FileName in~ ("QuickAssist.exe","AnyDesk.exe","TeamViewer.exe")
    | where isnotempty(AccountObjectId)
    | project
        AssistTime=Timestamp,
        DeviceId,
        DeviceName,
        AccountUpn,
        UserObjectId=AccountObjectId,
        AssistProcess=FileName,
        AssistCommandLine=ProcessCommandLine,
        AssistProcessUniqueId=ProcessUniqueId;


remote_assist
| join kind=inner teams on $left.UserObjectId == $right.VictimAccountObjectId
| where AssistTime between (TeamTime .. TeamTime + correlation_window)
| project TeamTime,AssistTime,DeviceName,AccountUpn,SenderEmailAddress,SenderDisplayName,SenderDomain,AssistProcess,AssistCommandLine,NetworkMessageId
| order by AssistTime desc

(
    index=<teams_message_index> sourcetype=<defender_messageevents_sourcetype> earliest=-7d
)
OR
(
    index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-7d
)
| eval
    user_object_id=coalesce(user_object_id,AccountObjectId,RecipientObjectId),
    sender=lower(coalesce(sender,SenderEmailAddress)),
    sender_display=lower(coalesce(sender_display,SenderDisplayName)),
    sender_domain=lower(replace(sender,"^.*@","")),
    device=coalesce(device,DeviceName,host),
    process_name=lower(coalesce(process_name,FileName)),
    event_type=case(
        isnotnull(SenderEmailAddress),"teams",
        process_name IN ("quickassist.exe","anydesk.exe","teamviewer.exe"),"remote_assist",
        true(),"other"
    ),
    external_support=if(
        event_type="teams"
        AND sender_domain!="example.com"
        AND (
            like(sender_display,"%helpdesk%")
            OR like(sender_display,"%help desk%")
            OR like(sender_display,"%it support%")
            OR like(sender_display,"%microsoft support%")
            OR like(sender_display,"%security%")
            OR like(sender_display,"%service desk%")
        ),1,0
    )
| where event_type!="other"
| sort 0 user_object_id _time
| streamstats current=f
    last(eval(if(event_type="teams" AND external_support=1,_time,null()))) as teams_time
    last(eval(if(event_type="teams" AND external_support=1,sender,null()))) as teams_sender
    last(eval(if(event_type="teams" AND external_support=1,sender_display,null()))) as teams_sender_display
    by user_object_id
| where event_type="remote_assist" AND isnotnull(teams_time) AND _time>=teams_time AND _time<=teams_time+1800
| table _time teams_time user_object_id device teams_sender teams_sender_display process_name ProcessCommandLine
| sort - _time

let assist =
    DeviceProcessEvents
    | where Timestamp >= ago(14d)
    | where FileName in~ ("QuickAssist.exe","AnyDesk.exe","TeamViewer.exe")
    | project DeviceId,DeviceName,AssistTime=Timestamp,AccountObjectId,AccountUpn,AssistTool=FileName;
let activity =
    DeviceProcessEvents
    | where Timestamp >= ago(14d)
    | where FileName in~ (
        "cmd.exe","powershell.exe","pwsh.exe","whoami.exe","hostname.exe",
        "ipconfig.exe","systeminfo.exe","nltest.exe","net.exe","net1.exe",
        "quser.exe","query.exe","tasklist.exe","sc.exe"
    )
    | project DeviceId,ActivityTime=Timestamp,AccountObjectId,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine;
assist
| join kind=inner activity on DeviceId,AccountObjectId
| where ActivityTime between (AssistTime .. AssistTime + 10m)
| summarize
    Commands=make_set(ProcessCommandLine,50),
    Processes=make_set(FileName,30),
    FirstActivity=min(ActivityTime),
    LastActivity=max(ActivityTime)
    by DeviceName,AccountUpn,AssistTool,AssistTime
| order by AssistTime desc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=-14d
| eval
    device=coalesce(device,DeviceName,host),
    user_object_id=coalesce(user_object_id,AccountObjectId),
    user=lower(coalesce(user,AccountUpn)),
    process_name=lower(coalesce(process_name,FileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    event_type=case(
        process_name IN ("quickassist.exe","anydesk.exe","teamviewer.exe"),"assist",
        process_name IN (
            "cmd.exe","powershell.exe","pwsh.exe","whoami.exe","hostname.exe",
            "ipconfig.exe","systeminfo.exe","nltest.exe","net.exe","net1.exe",
            "quser.exe","query.exe","tasklist.exe","sc.exe"
        ),"activity",
        true(),"other"
    )
| where event_type!="other"
| sort 0 device user_object_id _time
| streamstats current=f
    last(eval(if(event_type="assist",_time,null()))) as assist_time
    last(eval(if(event_type="assist",process_name,null()))) as assist_tool
    by device user_object_id
| where event_type="activity" AND isnotnull(assist_time) AND _time>=assist_time AND _time<=assist_time+600
| stats min(_time) as first_activity max(_time) as last_activity values(process_name) as processes values(process_command_line) as commands by device user assist_tool assist_time
| convert ctime(assist_time) ctime(first_activity) ctime(last_activity)
| sort - assist_time

DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ (
    "AcroServicesUpdater2_x64.exe",
    "ADNotificationManager.exe",
    "DlpUserAgent.exe"
)
| project
    Timestamp,
    DeviceId,
    DeviceName,
    AccountUpn,
    FileName,
    FolderPath,
    ProcessCommandLine,
    ProcessUniqueId,
    SHA1,
    SHA256,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessUniqueId
| order by Timestamp asc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=-7d
| eval
    process_name=lower(coalesce(process_name,FileName)),
    device=coalesce(device,DeviceName,host),
    user=lower(coalesce(user,AccountUpn)),
    process_path=coalesce(process_path,FolderPath),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    process_uid=coalesce(process_uid,ProcessUniqueId),
    parent_process_name=coalesce(parent_process_name,InitiatingProcessFileName),
    parent_command_line=coalesce(parent_command_line,InitiatingProcessCommandLine)
| where process_name IN (
    "acroservicesupdater2_x64.exe",
    "adnotificationmanager.exe",
    "dlpuseragent.exe"
)
| fields _time device user process_name process_path process_command_line process_uid SHA1 SHA256 parent_process_name parent_command_line
| sort 0 _time

let approved_management_devices=dynamic(["<MGMT-DEVICE-01>","<MGMT-DEVICE-02>"]);
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where RemotePort == 5985
| where DeviceName !in~ (approved_management_devices)
| summarize
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    Targets=make_set(RemoteIP,100),
    TargetCount=dcount(RemoteIP),
    Processes=make_set(InitiatingProcessFileName,30),
    Commands=make_set(InitiatingProcessCommandLine,50),
    Users=make_set(InitiatingProcessAccountUpn,30)
    by DeviceId,DeviceName
| order by TargetCount desc,LastSeen desc

index=<endpoint_network_index> sourcetype=<endpoint_network_events_sourcetype>
earliest=-14d
| eval
    device=coalesce(device,DeviceName,host),
    remote_ip=coalesce(remote_ip,RemoteIP,dest_ip),
    remote_port=coalesce(remote_port,RemotePort,dest_port),
    process_name=lower(coalesce(process_name,InitiatingProcessFileName)),
    process_command_line=coalesce(process_command_line,InitiatingProcessCommandLine),
    user=lower(coalesce(user,InitiatingProcessAccountUpn))
| where remote_port=5985 AND NOT device IN ("<MGMT-DEVICE-01>","<MGMT-DEVICE-02>")
| stats min(_time) as first_seen max(_time) as last_seen dc(remote_ip) as target_count values(remote_ip) as targets values(process_name) as processes values(process_command_line) as commands values(user) as users by device
| convert ctime(first_seen) ctime(last_seen)
| sort - target_count - last_seen

let known_remote_tools=dynamic([
    "QuickAssist.exe","AnyDesk.exe","TeamViewer.exe",
    "level.exe","level-rmm.exe"
]);
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where
    FileName in~ (known_remote_tools)
    or
    (
        FileName =~ "msiexec.exe"
        and ProcessCommandLine has_any ("http://","https://",".msi")
    )
| summarize
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    Executions=count(),
    Devices=make_set(DeviceName,100),
    Users=make_set(AccountUpn,50),
    Commands=make_set(ProcessCommandLine,100),
    Hashes=make_set(SHA256,50)
    by FileName,ProcessVersionInfoOriginalFileName
| order by FirstSeen desc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=-14d
| eval
    process_name=lower(coalesce(process_name,FileName)),
    original_name=lower(coalesce(original_name,ProcessVersionInfoOriginalFileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    device=coalesce(device,DeviceName,host),
    user=lower(coalesce(user,AccountUpn))
| where
    process_name IN ("quickassist.exe","anydesk.exe","teamviewer.exe","level.exe","level-rmm.exe")
    OR (
        process_name="msiexec.exe"
        AND (
            like(lower(process_command_line),"%http://%")
            OR like(lower(process_command_line),"%https://%")
            OR like(lower(process_command_line),"%.msi%")
        )
    )
| stats min(_time) as first_seen max(_time) as last_seen count as executions values(device) as devices values(user) as users values(process_command_line) as commands values(SHA256) as hashes by process_name original_name
| convert ctime(first_seen) ctime(last_seen)
| sort - first_seen

DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "rclone.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe"
| extend SourceReportedPattern =
    ProcessCommandLine has "copy "
    and ProcessCommandLine has "--config"
    and ProcessCommandLine has "--transfers"
    and ProcessCommandLine has "--checkers"
    and ProcessCommandLine has "--buffer-size"
| project Timestamp,DeviceName,AccountUpn,FileName,ProcessVersionInfoOriginalFileName,FolderPath,ProcessCommandLine,SourceReportedPattern,SHA1,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=-7d
| eval
    process_name=lower(coalesce(process_name,FileName)),
    original_name=lower(coalesce(original_name,ProcessVersionInfoOriginalFileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    device=coalesce(device,DeviceName,host),
    user=lower(coalesce(user,AccountUpn))
| where process_name="rclone.exe" OR original_name="rclone.exe"
| eval source_reported_pattern=if(
    like(lower(process_command_line),"%copy %")
    AND like(lower(process_command_line),"%--config%")
    AND like(lower(process_command_line),"%--transfers%")
    AND like(lower(process_command_line),"%--checkers%")
    AND like(lower(process_command_line),"%--buffer-size%"),
    1,0
)
| fields _time device user process_name original_name process_command_line source_reported_pattern SHA1 SHA256 InitiatingProcessFileName InitiatingProcessCommandLine
| sort - _time