// sigma convert -t kusto -p microsoft_365_defender. NOT run against a live tenant.
// ===== checkpoint_dynamiccli_unwrapped_command.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== esxi_destroy_v6_wiper_artefacts.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== esxi_vpxuser_ssh_login.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== file_event_lnx_checkpoint_campaign_files.yml (-p microsoft_365_defender)
DeviceFileEvents
| where (FolderPath endswith "/challenge_render.tpl" or FolderPath endswith "/tmp/.up.tpl" or FolderPath endswith "/tmp/CPconfigdaemon" or FolderPath endswith "/slot_CPconfigdaemon" or FolderPath endswith "/tmp/.bd.log" or FolderPath endswith "/lib/libcpfwcommon.so" or FolderPath endswith "/tmp/.p_sock" or FolderPath endswith "/DREAM_ANNEXATION.txt") or (FolderPath contains "/zz" and FolderPath endswith ".tpl")

// ===== net_firewall_checkpoint_php2shell_attacker_ips.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== net_firewall_checkpoint_tsga_port_11072.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== proc_creation_lnx_checkpoint_tsga_paths.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where (FolderPath endswith "/tmp/CPconfigdaemon" or FolderPath endswith "/slot_CPconfigdaemon" or FolderPath endswith "/tmp/des" or FolderPath endswith "/destroy_v6") or (ProcessCommandLine contains "/tmp/CPconfigdaemon" or ProcessCommandLine contains "slot_CPconfigdaemon" or ProcessCommandLine contains "/tmp/.bd.log" or ProcessCommandLine contains "/lib/libcpfwcommon.so" or ProcessCommandLine contains "/tmp/.p_sock" or ProcessCommandLine contains "destroy_v6")

