Detection: Windows Suspicious React or Next.js Child Process

 1
 2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
 3  from datamodel=Endpoint.Processes
 4  where
 5    Processes.parent_process_name = "node.exe"
 6    Processes.parent_process IN (
 7      "*--experimental-https*",
 8      "*--experimental-next-config-strip-types*",
 9      "*\\node_modules\\next*",
10      "*next dev*",
11      "*next start*",
12      "*next\" start*",
13      "*node_modules\\.bin\\\\..\\next*",
14      "*react-scripts start*",
15      "*start-server.js*",
16    )
17    AND
18    (
19      Processes.process_name IN (
20        "bash.exe",
21        "bitsadmin.exe",
22        "calc.exe",
23        "certutil.exe",
24        "cscript.exe",
25        "curl.exe",
26        "ftp.exe",
27        "ipconfig.exe",
28        "mshta.exe",
29        "netstat.exe",
30        "OpenConsole.exe",
31        "powershell.exe",
32        "pwsh.exe",
33        "regsvr32.exe",
34        "rundll32.exe",
35        "sh.exe",
36        "tftp.exe",
37        "wget.exe",
38        "wmic.exe",
39        "wscript.exe",
40        "wsl.exe",
41        "wt.exe"
42      )
43      OR
44      (
45        Processes.process_name = "cmd.exe"
46        AND NOT Processes.process = "*/d /s /c *"
47      )
48      OR
49      (
50        Processes.process_name = "cmd.exe"
51        Processes.process = "*/d /s /c *"
52        AND NOT (
53          Processes.process = "*git config --local --get remote.origin.url*"
54          OR
55          (
56            Processes.process = "*netstat -ano 
57| findstr /C:*"
58            Processes.process = "* 
59| findstr LISTENING*"
60          )
61          OR
62          (
63            Processes.parent_process = "*--experimental-https*"
64            Processes.process = "*\\mkcert\\*"
65            Processes.process IN ("* -CAROOT*", "* -install *")
66          )
67        )
68      )
69    )
70by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
71   Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
72   Processes.parent_process_name Processes.parent_process_path Processes.process
73   Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
74   Processes.process_integrity_level Processes.process_name Processes.process_path
75   Processes.user Processes.user_id Processes.vendor_product
76
77
78| `drop_dm_object_name(Processes)`
79
80| `security_content_ctime(firstTime)`
81
82| `security_content_ctime(lastTime)`
83
84| `windows_suspicious_react_or_next_js_child_process_filter`