// sigma convert -t kusto --without-pipeline, generated 12 Nov 2026. NOT run against a live tenant.
// ===== file_event_lnx_apache_writes_script_to_webroot.yml (--without-pipeline)
(Image endswith "/httpd" or Image endswith "/apache2") and (TargetFilename contains "/var/www/" or TargetFilename contains "/srv/www/" or TargetFilename contains "/usr/local/apache2/htdocs/") and (TargetFilename endswith ".php" or TargetFilename endswith ".phtml" or TargetFilename endswith ".phar" or TargetFilename endswith ".jsp" or TargetFilename endswith ".cgi" or TargetFilename endswith ".pl" or TargetFilename endswith ".py" or TargetFilename endswith ".sh" or TargetFilename endswith ".so" or TargetFilename endswith "/.htaccess")

// ===== file_event_win_apache_writes_script_to_webroot.yml (--without-pipeline)
Image endswith "\\httpd.exe" and (TargetFilename contains "\\htdocs\\" or TargetFilename contains "\\Apache24\\" or TargetFilename contains "\\xampp\\") and (TargetFilename endswith ".php" or TargetFilename endswith ".phtml" or TargetFilename endswith ".phar" or TargetFilename endswith ".jsp" or TargetFilename endswith ".asp" or TargetFilename endswith ".aspx" or TargetFilename endswith ".cgi" or TargetFilename endswith ".pl" or TargetFilename endswith ".dll" or TargetFilename endswith ".exe" or TargetFilename endswith "\\.htaccess")

// ===== proc_creation_lnx_apache_spawns_shell_or_downloader.yml (--without-pipeline)
(ParentImage endswith "/httpd" or ParentImage endswith "/apache2") and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/busybox" or Image endswith "/python3" or Image endswith "/perl" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat")

// ===== proc_creation_win_apache_spawns_shell.yml (--without-pipeline)
ParentImage endswith "\\httpd.exe" and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\mshta.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\curl.exe")

