// sigma convert -t kusto -p sentinel_asim, generated 12 Nov 2026. NOT run against a live tenant.
// ===== file_event_lnx_apache_writes_script_to_webroot.yml (-p sentinel_asim)
imFileEvent
| where (TargetFilePath endswith "/httpd" or TargetFilePath endswith "/apache2") and (TargetFileName contains "/var/www/" or TargetFileName contains "/srv/www/" or TargetFileName contains "/usr/local/apache2/htdocs/") and (TargetFileName endswith ".php" or TargetFileName endswith ".phtml" or TargetFileName endswith ".phar" or TargetFileName endswith ".jsp" or TargetFileName endswith ".cgi" or TargetFileName endswith ".pl" or TargetFileName endswith ".py" or TargetFileName endswith ".sh" or TargetFileName endswith ".so" or TargetFileName endswith "/.htaccess")

// ===== file_event_win_apache_writes_script_to_webroot.yml (-p sentinel_asim)
imFileEvent
| where TargetFilePath endswith "\\httpd.exe" and (TargetFileName contains "\\htdocs\\" or TargetFileName contains "\\Apache24\\" or TargetFileName contains "\\xampp\\") and (TargetFileName endswith ".php" or TargetFileName endswith ".phtml" or TargetFileName endswith ".phar" or TargetFileName endswith ".jsp" or TargetFileName endswith ".asp" or TargetFileName endswith ".aspx" or TargetFileName endswith ".cgi" or TargetFileName endswith ".pl" or TargetFileName endswith ".dll" or TargetFileName endswith ".exe" or TargetFileName endswith "\\.htaccess")

// ===== proc_creation_lnx_apache_spawns_shell_or_downloader.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "/httpd" or ParentProcessName endswith "/apache2") or (ActingProcessName endswith "/httpd" or ActingProcessName endswith "/apache2")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/busybox" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat")

// ===== proc_creation_win_apache_spawns_shell.yml (-p sentinel_asim)
imProcessCreate
| where (ParentProcessName endswith "\\httpd.exe" or ActingProcessName endswith "\\httpd.exe") and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\curl.exe")

