// sigma convert -t kusto -p azure_monitor. NOT run against a live tenant.
// ===== checkpoint_dynamiccli_unwrapped_command.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== esxi_destroy_v6_wiper_artefacts.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== esxi_vpxuser_ssh_login.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== file_event_lnx_checkpoint_campaign_files.yml (-p azure_monitor)
SecurityEvent
| where (ObjectName endswith "/challenge_render.tpl" or ObjectName endswith "/tmp/.up.tpl" or ObjectName endswith "/tmp/CPconfigdaemon" or ObjectName endswith "/slot_CPconfigdaemon" or ObjectName endswith "/tmp/.bd.log" or ObjectName endswith "/lib/libcpfwcommon.so" or ObjectName endswith "/tmp/.p_sock" or ObjectName endswith "/DREAM_ANNEXATION.txt") or (ObjectName contains "/zz" and ObjectName endswith ".tpl")

// ===== net_firewall_checkpoint_php2shell_attacker_ips.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== net_firewall_checkpoint_tsga_port_11072.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== proc_creation_lnx_checkpoint_tsga_paths.yml (-p azure_monitor)
SecurityEvent
| where (NewProcessName endswith "/tmp/CPconfigdaemon" or NewProcessName endswith "/slot_CPconfigdaemon" or NewProcessName endswith "/tmp/des" or NewProcessName endswith "/destroy_v6") or (CommandLine contains "/tmp/CPconfigdaemon" or CommandLine contains "slot_CPconfigdaemon" or CommandLine contains "/tmp/.bd.log" or CommandLine contains "/lib/libcpfwcommon.so" or CommandLine contains "/tmp/.p_sock" or CommandLine contains "destroy_v6")

