// sigma convert -t kusto -p azure_monitor, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_chrome_spawn_shell.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "/opt/google/chrome/chrome" or ParentProcessName endswith "/chromium" or ParentProcessName endswith "/chromium-browser" or ParentProcessName endswith "/microsoft-edge") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/zsh" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc") and (not((CommandLine contains "xdg-settings" or CommandLine contains "xdg-open" or CommandLine contains "xdg-mime")))

// ===== macos_chrome_spawn_shell.yml (-p azure_monitor)
SecurityEvent
| where ParentProcessName contains "/Google Chrome.app/" and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/zsh" or NewProcessName endswith "/osascript" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl" or NewProcessName endswith "/curl") and (not((CommandLine contains "GoogleUpdater" or CommandLine contains "GoogleSoftwareUpdate" or CommandLine contains "ksadmin")))

// ===== win_browser_run_key_persistence.yml (-p azure_monitor)
// NOT CONVERTED: Invalid SigmaDetectionItem field name encountered: Details. This pipeline maps Windows rules to SecurityEvent, which has no field for it.

// ===== win_browser_script_file_drop.yml (-p azure_monitor)
SecurityEvent
| where ((NewProcessName endswith "\\chrome.exe" or NewProcessName endswith "\\msedge.exe" or NewProcessName endswith "\\brave.exe" or NewProcessName endswith "\\opera.exe" or NewProcessName endswith "\\vivaldi.exe") and (ObjectName endswith ".hta" or ObjectName endswith ".vbs" or ObjectName endswith ".vbe" or ObjectName endswith ".js" or ObjectName endswith ".jse" or ObjectName endswith ".wsf" or ObjectName endswith ".ps1" or ObjectName endswith ".bat" or ObjectName endswith ".cmd" or ObjectName endswith ".scr" or ObjectName endswith ".lnk")) and (not((ObjectName endswith "\\User Data*" or ObjectName endswith "\\Google\\Chrome\\Application*" or ObjectName endswith "\\Microsoft\\Edge\\Application*")))

// ===== win_chromium_browser_suspicious_child.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\chrome.exe" or ParentProcessName endswith "\\msedge.exe" or ParentProcessName endswith "\\brave.exe" or ParentProcessName endswith "\\opera.exe" or ParentProcessName endswith "\\vivaldi.exe") and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\schtasks.exe" or NewProcessName endswith "\\wmic.exe") and (not((NewProcessName endswith "\\cmd.exe" and (CommandLine contains "chrome-extension://" and CommandLine contains "--parent-window="))))

