Part 1

Employees
| where role == "Web Administrator"

ProcessEvents
| where hostname == "MYZB-LAPTOP"
 and process_commandline contains "Shadow Truth"

ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline contains "frog_mall_meme"

FileCreationEvents
| where hostname == "MYZB-LAPTOP"
 and filename startswith "frog_mall_meme"

OutboundNetworkEvents
| where src_ip == '10.10.0.8'
| where url contains 'frog_mall_meme'
| extend domain = parse_url(url).Host
| distinct tostring(domain)
// ronniesdankmemes.com

ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline has "password"

ProcessEvents
| where hostname == "MYZB-LAPTOP"
| where process_commandline contains "password"

PassiveDns
| where domain == "newdevelopmentupdates.org"

PassiveDns
| where domain == "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain

let TA_ips =
PassiveDns
| where domain == 'newdevelopmentupdates.org'
| distinct ip;
AuthenticationEvents
| where src_ip in (TA_ips)
| where username == 'anbath'

let TA_domains =
PassiveDns
| where domain == 'newdevelopmentupdates.org'
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient == '[email protected]'
| where link has_any(TA_domains)

OutboundNetworkEvents
| where src_ip == "10.10.0.8"
| where url  startswith "<https://greenprojectnews.net/share/modules/files/share/enter>"
| where url has "username"

Part 2

Employees
| where role == "Chief Architect"

let TA_domains =
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient has "[email protected]" or recipient has "[email protected]"
| where link has_any (TA_domains)

InboundNetworkEvents
| where src_ip == "239.72.6.37"
 or src_ip == "239.72.6.38"
//| distinct url
| distinct referrer

AuthenticationEvents
| where username contains "solindgren"
| where user_agent contains "Firefox/3.6.11"

ProcessEvents
| where username contains "solindgren" or username contains "erbjorn"
| where process_commandline contains "powershell"

ProcessEvents
| where hostname in ("LRJP-DESKTOP", "VJVS-MACHINE")  // Erik & Sofia's machines
//| where process_commandline has "Remove-Item"
| where process_commandline has_any ("Remove-Item", "del", "rm", "Remove-ItemProperty", "Clear-Content")
| order by timestamp asc

let TA_domains =
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
ProcessEvents
| where hostname in ("LRJP-DESKTOP", "VJVS-MACHINE")
| where process_commandline has_any (TA_domains)

ProcessEvents
| where hostname in ("LRJP-DESKTOP", "VJVS-MACHINE")
| where process_commandline has "rename"

Part 3

let j_karlsson = Employees
| where name has "johanna"
| distinct ip_addr;
InboundNetworkEvents
| where src_ip == "239.72.6.37"
 or src_ip == "239.72.6.38"
| where url contains "CEO"
| distinct url

let TA_domains =
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip
| lookup PassiveDns on ip
| distinct domain;
Email
| where recipient has "[email protected]"
| where link has_any (TA_domains)

OutboundNetworkEvents
| where src_ip == "10.10.0.6"
| where url == "<http://newdevelopmentupdates.org/public/signin>"

let TA_ips = 
PassiveDns
| where domain contains "newdevelopmentupdates.org"
| distinct ip;
AuthenticationEvents
| where src_ip in (TA_ips)
| where username == "jokarlsson"

ProcessEvents
| where hostname == "BLVR-MACHINE"
| where timestamp >= datetime(6-27-2024)
| where process_commandline contains "users"

Email
| where sender == "[email protected]"
| where recipient contains "erik"

Email
| where sender == "[email protected]"
| where recipient == "[email protected]"

let TA_domains =
PassiveDns
| where domain has "newdevelopmentupdates.org"
| distinct domain;
ProcessEvents
| where process_commandline has "zip"

Email
| where sender has "framtidxdevcorp.com"
| where subject has "chunk" or subject has "copy"
| distinct recipient

Email
| where recipient !has "framtidxdevcorp"
| where subject has "Confidential"