Teams Helpdesk Impersonation + Node.js MSI Implant: Human-Operated Intrusion Chain — OTX Pulse Analysis & Detection Pack

---
title: Suspicious MSI Installation Spawned via PowerShell
description: Detects msiexec.exe executing an MSI package with PowerShell as parent process, consistent with helpdesk-impersonation campaigns delivering Node.js implants via malicious MSI loaders.
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\msiexec.exe'
    selection_parent:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cmd:
        CommandLine|contains:
            - '/i '
            - '/package'
            - '.msi'
    condition: selection_img and selection_parent and selection_cmd
falsepositives:
    - Legitimate software deployment via PowerShell scripts (SCCM, Intune packaging)
level: high
tags:
    - attack.t1218.007
    - attack.t1059.001
---
title: Node.js Runtime Execution from Non-Standard Path
description: Detects node.exe executing from user-writable or non-standard directories with a JavaScript file argument, indicating a portable Node.js implant staged by an MSI loader.
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\node.exe'
    selection_paths:
        Image|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
            - '\Temp\'
            - '\Windows\Temp\'
    selection_cmd:
        CommandLine|endswith: '.js'
    filter_standard:
        Image|startswith:
            - 'C:\Program Files\nodejs\'
            - 'C:\Program Files (x86)\nodejs\'
    condition: selection_img and selection_paths and selection_cmd and not filter_standard
falsepositives:
    - Developers with local Node.js projects
    - Electron-based applications bundling node
level: high
tags:
    - attack.t1059.007
    - attack.t1036
---
title: WinRM-Based Lateral Movement or Domain Reconnaissance via Node or RMM Session
description: Detects WinRM service (winrs/winrm) spawning command shells or reconnaissance utilities, combined with domain enumeration commands, consistent with post-compromise lateral movement in helpdesk impersonation intrusions.
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\winrshost.exe'
            - '\wsmprovhost.exe'
    selection_recon:
        CommandLine|contains:
            - 'nltest'
            - 'net group "Domain Admins"'
            - 'net user /domain'
            - 'dsquery'
            - 'quser'
            - 'net view'
    condition: selection_parent and selection_recon
falsepositives:
    - Administrators performing legitimate remote domain management via WinRM/PSRemoting
level: medium
tags:
    - attack.t1021.006
    - attack.t1482
    - attack.t1069.002

// Hunt: Teams helpdesk impersonation -> RMM -> MSI -> Node.js implant chain
// Looks for node.exe network activity from suspicious paths and msiexec launches by PowerShell
let suspicious_hashes = dynamic([
    "4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d",
    "a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676",
    "cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5",
    "0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3",
    "69e10e0cb7bb2137ebea12971adb02c662cf5543a4f8c9530812bcbf7b183a23",
    "a135fe4df18c711097e69b4f27ea32a74a955160bf2fb12da841f21866d95d87"
]);
let lookback = 14d;
let NodeNet = DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName =~ "node.exe"
    | where InitiatingProcessFolderPath has_any ("AppData", "ProgramData", "Public", "Temp")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let MsiDrop = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName =~ "msiexec.exe"
    | where InitiatingProcessFileName has_any ("powershell.exe", "pwsh.exe")
    | project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256;
let HashHits = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where SHA256 in (suspicious_hashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine;
let C2Dns = DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl == "dssdfvsdfvsdfvsdgbfbdvdzv.org"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP;
union NodeNet, MsiDrop, HashHits, C2Dns
| sort by TimeGenerated desc

# IOC & artifact hunt: Teams helpdesk impersonation / Node.js MSI implant
# Run elevated across endpoints (or via Intune/SCCM/remote PS)

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Known malicious SHA256 hashes from OTX pulse
$malHashes = @(
  '4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d',
  'a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676',
  'cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5',
  '0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3',
  '69e10e0cb7bb2137ebea12971adb02c662cf5543a4f8c9530812bcbf7b183a23',
  'a135fe4df18c711097e69b4f27ea32a74a955160bf2fb12da841f21866d95d87'
)

# 2. Scan user-writable paths for portable node.exe runtimes
$suspectPaths = @("$env:ProgramData", "$env:PUBLIC", "$env:TEMP", "$env:LOCALAPPDATA", "$env:APPDATA")
foreach ($p in $suspectPaths) {
    Get-ChildItem -Path $p -Recurse -Filter 'node.exe' -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        $report += [pscustomobject]@{
            Check = 'Portable Node.js runtime'
            Path  = $_.FullName
            SHA256 = $h
            Flag  = $(if ($malHashes -contains $h) {'KNOWN MALICIOUS'} else {'Review'})
        }
    }
}

# 3. Hash-match any MSI payloads left on disk
Get-ChildItem -Path "$env:TEMP","$env:ProgramData" -Recurse -Include *.msi -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($malHashes -contains $h) {
        $report += [pscustomobject]@{Check='Malicious MSI'; Path=$_.FullName; SHA256=$h; Flag='KNOWN MALICIOUS'}
    }
}

# 4. Check for unauthorized RMM tools (adjust allowlist to your org)
$rmmNames = 'AnyDesk','TeamViewer','ScreenConnect','ConnectWise','Splashtop','QuickAssist','Atera','NinjaRMM','LogMeIn','UltraVNC','RustDesk'
$installed = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
             Where-Object { $d=$_.DisplayName; $rmmNames | Where-Object { $d -match $_ } }
foreach ($app in $installed) {
    $report += [pscustomobject]@{Check='RMM tool installed'; Path=$app.DisplayName; SHA256=''; Flag='Verify authorized'}
}

# 5. Persistence: Run keys referencing node or suspicious js
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
           'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
           'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
           'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
foreach ($k in $runKeys) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'node\.exe|\.js' } | ForEach-Object {
        $report += [pscustomobject]@{Check='Run key persistence'; Path="$k -> $($_.Name)=$($_.Value)"; SHA256=''; Flag='Review'}
    }
}

# 6. Scheduled tasks invoking node.exe or .js payloads
Get-ScheduledTask | Where-Object { ($_.Actions | Out-String) -match 'node\.exe|\.js' } | ForEach-Object {
    $report += [pscustomobject]@{Check='Scheduled task persistence'; Path=$_.TaskName; SHA256=''; Flag='Review'}
}

# 7. Active network connections from node.exe or to known C2
Get-NetTCPConnection -State Established | Where-Object {
    (Get-Process -Id $_.OwningProcess).ProcessName -eq 'node'
} | ForEach-Object {
    $report += [pscustomobject]@{Check='node.exe outbound connection'; Path="$($_.RemoteAddress):$($_.RemotePort)"; SHA256=''; Flag='Review'}
}
Resolve-DnsName 'dssdfvsdfvsdfvsdgbfbdvdzv.org' -ErrorAction SilentlyContinue | ForEach-Object {
    $report += [pscustomobject]@{Check='Known C2 domain resolves'; Path=$_.Name; SHA256=''; Flag='BLOCK'}
}

# 8. WinRM listener state (lateral movement exposure)
$winrm = Get-Service WinRM
$report += [pscustomobject]@{Check='WinRM service state'; Path=$winrm.Status; SHA256=''; Flag=$(if($winrm.Status -eq 'Running'){'Review necessity'}else{'OK'})}

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\helpdesk_impersonation_hunt.csv" -NoTypeInformation
Write-Host "`nHunt complete. Results: $($report.Count) findings -> $env:TEMP\helpdesk_impersonation_hunt.csv"