// sigma convert -t kusto --without-pipeline. NOT run against a live tenant.
// ===== checkpoint_dynamiccli_unwrapped_command.yml (--without-pipeline)
("Received =" and (not("CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;"))) or "Received = #return_value#"

// ===== esxi_destroy_v6_wiper_artefacts.yml (--without-pipeline)
"destroy_v6" or "DREAM_ANNEXATION.txt" or "/tmp/des "

// ===== esxi_vpxuser_ssh_login.yml (--without-pipeline)
"vpxuser" and "sshd"

// ===== file_event_lnx_checkpoint_campaign_files.yml (--without-pipeline)
(TargetFilename endswith "/challenge_render.tpl" or TargetFilename endswith "/tmp/.up.tpl" or TargetFilename endswith "/tmp/CPconfigdaemon" or TargetFilename endswith "/slot_CPconfigdaemon" or TargetFilename endswith "/tmp/.bd.log" or TargetFilename endswith "/lib/libcpfwcommon.so" or TargetFilename endswith "/tmp/.p_sock" or TargetFilename endswith "/DREAM_ANNEXATION.txt") or (TargetFilename contains "/zz" and TargetFilename endswith ".tpl")

// ===== net_firewall_checkpoint_php2shell_attacker_ips.yml (--without-pipeline)
(src_ip in~ ("130.94.19.204", "130.94.19.168")) or (dst_ip in~ ("130.94.19.204", "130.94.19.168"))

// ===== net_firewall_checkpoint_tsga_port_11072.yml (--without-pipeline)
dst_port == 11072

// ===== proc_creation_lnx_checkpoint_tsga_paths.yml (--without-pipeline)
(Image endswith "/tmp/CPconfigdaemon" or Image endswith "/slot_CPconfigdaemon" or Image endswith "/tmp/des" or Image endswith "/destroy_v6") or (CommandLine contains "/tmp/CPconfigdaemon" or CommandLine contains "slot_CPconfigdaemon" or CommandLine contains "/tmp/.bd.log" or CommandLine contains "/lib/libcpfwcommon.so" or CommandLine contains "/tmp/.p_sock" or CommandLine contains "destroy_v6")

