// sigma convert -t kusto -p microsoft_xdr, generated 12 Nov 2026. NOT run against a live tenant.
// ===== file_event_lnx_apache_writes_script_to_webroot.yml (-p microsoft_xdr)
DeviceFileEvents
| where (InitiatingProcessFolderPath endswith "/httpd" or InitiatingProcessFolderPath endswith "/apache2") and (FolderPath contains "/var/www/" or FolderPath contains "/srv/www/" or FolderPath contains "/usr/local/apache2/htdocs/") and (FolderPath endswith ".php" or FolderPath endswith ".phtml" or FolderPath endswith ".phar" or FolderPath endswith ".jsp" or FolderPath endswith ".cgi" or FolderPath endswith ".pl" or FolderPath endswith ".py" or FolderPath endswith ".sh" or FolderPath endswith ".so" or FolderPath endswith "/.htaccess")

// ===== file_event_win_apache_writes_script_to_webroot.yml (-p microsoft_xdr)
DeviceFileEvents
| where InitiatingProcessFolderPath endswith "\\httpd.exe" and (FolderPath contains "\\htdocs\\" or FolderPath contains "\\Apache24\\" or FolderPath contains "\\xampp\\") and (FolderPath endswith ".php" or FolderPath endswith ".phtml" or FolderPath endswith ".phar" or FolderPath endswith ".jsp" or FolderPath endswith ".asp" or FolderPath endswith ".aspx" or FolderPath endswith ".cgi" or FolderPath endswith ".pl" or FolderPath endswith ".dll" or FolderPath endswith ".exe" or FolderPath endswith "\\.htaccess")

// ===== proc_creation_lnx_apache_spawns_shell_or_downloader.yml (-p microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "/httpd" or InitiatingProcessFolderPath endswith "/apache2") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/busybox" or FolderPath endswith "/python3" or FolderPath endswith "/perl" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat")

// ===== proc_creation_win_apache_spawns_shell.yml (-p microsoft_xdr)
DeviceProcessEvents
| where InitiatingProcessFolderPath endswith "\\httpd.exe" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\curl.exe")

