// sigma convert -t kusto -p azure_monitor, generated 12 Nov 2026. NOT run against a live tenant.
// ===== file_event_lnx_apache_writes_script_to_webroot.yml (-p azure_monitor)
SecurityEvent
| where (NewProcessName endswith "/httpd" or NewProcessName endswith "/apache2") and (ObjectName contains "/var/www/" or ObjectName contains "/srv/www/" or ObjectName contains "/usr/local/apache2/htdocs/") and (ObjectName endswith ".php" or ObjectName endswith ".phtml" or ObjectName endswith ".phar" or ObjectName endswith ".jsp" or ObjectName endswith ".cgi" or ObjectName endswith ".pl" or ObjectName endswith ".py" or ObjectName endswith ".sh" or ObjectName endswith ".so" or ObjectName endswith "/.htaccess")

// ===== file_event_win_apache_writes_script_to_webroot.yml (-p azure_monitor)
SecurityEvent
| where NewProcessName endswith "\\httpd.exe" and (ObjectName endswith "\\htdocs*" or ObjectName endswith "\\Apache24*" or ObjectName endswith "\\xampp*") and (ObjectName endswith ".php" or ObjectName endswith ".phtml" or ObjectName endswith ".phar" or ObjectName endswith ".jsp" or ObjectName endswith ".asp" or ObjectName endswith ".aspx" or ObjectName endswith ".cgi" or ObjectName endswith ".pl" or ObjectName endswith ".dll" or ObjectName endswith ".exe" or ObjectName endswith "\\.htaccess")

// ===== proc_creation_lnx_apache_spawns_shell_or_downloader.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "/httpd" or ParentProcessName endswith "/apache2") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/busybox" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat")

// ===== proc_creation_win_apache_spawns_shell.yml (-p azure_monitor)
SecurityEvent
| where ParentProcessName endswith "\\httpd.exe" and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\curl.exe")

