Part 1
Employees
| where role == "Web Administrator"
ProcessEvents
| where hostname == "MYZB-LAPTOP"
and process_commandline contains "Shadow Truth"
ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline contains "frog_mall_meme"
FileCreationEvents
| where hostname == "MYZB-LAPTOP"
and filename startswith "frog_mall_meme"
OutboundNetworkEvents
| where src_ip == '10.10.0.8'
| where url contains 'frog_mall_meme'
| extend domain = parse_url(url).Host
| distinct tostring(domain)
// ronniesdankmemes.com
ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline has "password"
ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline contains "password"
PassiveDns
| where domain == "newdevelopmentupdates.org"
PassiveDns
| where domain == "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain
let TA_ips =
PassiveDns
| where domain == 'newdevelopmentupdates.org'
| distinct ip;
AuthenticationEvents
| where src_ip in (TA_ips)
| where username == 'anbath'
let TA_domains =
PassiveDns
| where domain == 'newdevelopmentupdates.org'
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient == '[email protected]'
| where link has_any(TA_domains)
OutboundNetworkEvents
| where src_ip == "10.10.0.8"
| where url startswith "<https://greenprojectnews.net/share/modules/files/share/enter>"
| where url has "username"
Part 2
Employees
| where role == "Chief Architect"
let TA_domains =
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient has "[email protected]" or recipient has "[email protected]"
| where link has_any (TA_domains)
InboundNetworkEvents
| where src_ip == "239.72.6.37"
or src_ip == "239.72.6.38"
//| distinct url
| distinct referrer
AuthenticationEvents
| where username contains "solindgren"
| where user_agent contains "Firefox/3.6.11"
ProcessEvents
| where username contains "solindgren" or username contains "erbjorn"
| where process_commandline contains "powershell"
ProcessEvents
| where hostname in ("LRJP-DESKTOP", "VJVS-MACHINE") // Erik & Sofia's machines
//| where process_commandline has "Remove-Item"
| where process_commandline has_any ("Remove-Item", "del", "rm", "Remove-ItemProperty", "Clear-Content")
| order by timestamp asc
let TA_domains =
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
ProcessEvents
| where hostname in ("LRJP-DESKTOP", "VJVS-MACHINE")
| where process_commandline has_any (TA_domains)
ProcessEvents
| where hostname in ("LRJP-DESKTOP", "VJVS-MACHINE")
| where process_commandline has "rename"
Part 3
let j_karlsson = Employees
| where name has "johanna"
| distinct ip_addr;
InboundNetworkEvents
| where src_ip == "239.72.6.37"
or src_ip == "239.72.6.38"
| where url contains "CEO"
| distinct url
let TA_domains =
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient has "[email protected]"
| where link has_any (TA_domains)
OutboundNetworkEvents
| where src_ip == "10.10.0.6"
| where url == "<http://newdevelopmentupdates.org/public/signin>"
let TA_ips =
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip;
AuthenticationEvents
| where src_ip in (TA_ips)
| where username == "jokarlsson"
ProcessEvents
| where hostname == "BLVR-MACHINE"
| where timestamp >= datetime(6-27-2024)
| where process_commandline contains "users"
Email
| where sender == "[email protected]"
| where recipient contains "erik"
Email
| where sender == "[email protected]"
| where recipient == "[email protected]"
let TA_domains =
PassiveDns
| where domain has "newdevelopmentupdates.org"
| distinct domain;
ProcessEvents
| where process_commandline has "zip"
Email
| where sender has "framtidxdevcorp.com"
| where subject has "chunk" or subject has "copy"
| distinct recipient
Email
| where recipient !has "framtidxdevcorp"
| where subject has "Confidential"