Node.js execution followed by network activity

[rule]
description = """
Identifies attempts to execute JavaScript using the Node.js module followed by network connection. Adversaries may abuse
this utility to execute malicious JavaScript.
"""
id = "e22838d1-b241-4d77-9a00-ca316531cc82"
license = "Elastic License v2"
name = "Node.js execution followed by network activity"
os_list = ["windows"]
reference = ["https://nodejs.org"]
version = "1.0.8"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
 process.parent.name : ("wscript.exe", "powershell.exe") and
 (process.name : "node.exe" or process.pe.original_file_name == "node.exe" or process.code_signature.subject_name == "OpenJS Foundation") and
 not process.args : ("install", "--prefer-offline", "run-driver") and not process.parent.name : "node.exe" and
 not process.executable :
            ("?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\Prey\\versions\\*\\bin\\node.exe") and
 not (process.code_signature.subject_name in ("Western Union Holdings Inc.", "Autodesk, Inc.", "Tobii AB") and process.code_signature.trusted == true) and
 not process.hash.sha256 in ("767c9498a55e9a093c75761c69996360b73b19a0d43b68f92a8eaccc6079f666", "80eafa18b85001b1773471414150c96ad52e0dd6985a4c25d7d5083fb04ae4fd")]
[dns where event.action == "lookup_requested" and
 not dns.question.name in ("nodejs.org", "localhost", "fonts.googleapis.com", "www.google-analytics.com", "api2.cursor.sh", "registry.npmjs.org", "api.anthropic.com", "versions-prod.lmstudio.ai") and
 not (process.executable : "D:\\Azure-BuildAgent*\\node.exe" and dns.question.name : "proxy4zscaler.*.ch")]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.0"