On a Windows system, a non-standard image downloader was used to fetch a remote file by passing a URL to a lockscreen utility. Identify the executable responsible for launching that activity.

DeviceProcessEvents
| where ProcessCommandLine contains "http" and (FileName contains "lockscreen" or ProcessCommandLine contains "lockscreen")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| summarize count() by InitiatingProcessFileName, DeviceName
| order by count_ desc

let StartTime = ago(1d);
let EndTime = now();

let DownloaderLaunchers = DeviceProcessEvents
| where TimeGenerated between (StartTime .. EndTime)
| where isnotempty(InitiatingProcessFileName)
| where isnotempty(ProcessCommandLine)
| where ProcessCommandLine has_any("http://","https://") or InitiatingProcessCommandLine has_any("http://","https://")
| project TimeGenerated, DownloaderProcess = FileName, DownloaderCmdLine = ProcessCommandLine, DownloaderProcessId = ProcessId, LauncherProcess = InitiatingProcessFileName, LauncherCmdLine = InitiatingProcessCommandLine, LauncherProcessId = InitiatingProcessId;

let NetworkEvents = DeviceNetworkEvents
| where TimeGenerated between (StartTime .. EndTime)
| where RemoteUrl has_any("http://","https://")
| project NetTime = TimeGenerated, NetRemoteUrl = RemoteUrl, NetInitiatingProcessId = InitiatingProcessId;

DownloaderLaunchers
| join kind=inner (NetworkEvents) on $left.DownloaderProcessId == $right.NetInitiatingProcessId
| project NetTime, NetRemoteUrl, LauncherProcess, LauncherCmdLine, LauncherProcessId, DownloaderProcess, DownloaderCmdLine, DownloaderProcessId
| sort by NetTime desc

DeviceNetworkEvents
| where isnotempty(RemoteUrl)
| summarize arg_max(TimeGenerated, *) by InitiatingProcessFileName
| project InitiatingProcessFileName, RemoteUrl, TimeGenerated, InitiatingProcessCommandLine

// 1. Look for the lock-screen image download utility being abused
DeviceProcessEvents
| where FileName =~ "desktopimgdownldr.exe"          // Lock-screen image downloader
| where ProcessCommandLine has_any ("http://", "https://") // Must have been passed a URL
// 2. Bring back the process that actually launched the utility
| project
    TimeGenerated,
    DeviceId,
    DeviceName,
    DownloaderCommandLine = ProcessCommandLine,
    DownloaderFolder     = FolderPath,
    ParentExecutable     = InitiatingProcessFileName,
    ParentCommandLine    = InitiatingProcessCommandLine,
    ParentFolder         = InitiatingProcessFolderPath,
    ParentSHA256         = InitiatingProcessSHA256,
    ParentIntegrity      = InitiatingProcessIntegrityLevel
// 3. Return distinct launchers – the executables responsible for the activity
| summarize Events = count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by 
          DeviceId,
          DeviceName,
          ParentExecutable,
          ParentCommandLine,
          ParentFolder,
          ParentSHA256,
          ParentIntegrity
| sort by LastSeen desc

union DeviceProcessEvents, DeviceImageLoadEvents
| where tolower(InitiatingProcessCommandLine) contains "http://" or tolower(InitiatingProcessCommandLine) contains "https://"
| where tolower(InitiatingProcessCommandLine) contains "lockscreen" or tolower(ProcessCommandLine) contains "lockscreen"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessParentFileName, FolderPath
| order by TimeGenerated desc