// sigma convert -t kusto -p microsoft_365_defender, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_chrome_spawn_shell.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "/opt/google/chrome/chrome" or InitiatingProcessFolderPath endswith "/chromium" or InitiatingProcessFolderPath endswith "/chromium-browser" or InitiatingProcessFolderPath endswith "/microsoft-edge") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/zsh" or FolderPath endswith "/python3" or FolderPath endswith "/perl" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc") and (not((ProcessCommandLine contains "xdg-settings" or ProcessCommandLine contains "xdg-open" or ProcessCommandLine contains "xdg-mime")))

// ===== macos_chrome_spawn_shell.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where InitiatingProcessFolderPath contains "/Google Chrome.app/" and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/zsh" or FolderPath endswith "/osascript" or FolderPath endswith "/python3" or FolderPath endswith "/perl" or FolderPath endswith "/curl") and (not((ProcessCommandLine contains "GoogleUpdater" or ProcessCommandLine contains "GoogleSoftwareUpdate" or ProcessCommandLine contains "ksadmin")))

// ===== win_browser_run_key_persistence.yml (-p microsoft_365_defender)
DeviceRegistryEvents
| where ((InitiatingProcessFolderPath endswith "\\chrome.exe" or InitiatingProcessFolderPath endswith "\\msedge.exe" or InitiatingProcessFolderPath endswith "\\brave.exe" or InitiatingProcessFolderPath endswith "\\opera.exe" or InitiatingProcessFolderPath endswith "\\vivaldi.exe") and RegistryKey contains "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") and (not((RegistryValueData contains "\\Google\\Chrome\\Application\\chrome.exe" or RegistryValueData contains "\\Microsoft\\Edge\\Application\\msedge.exe" or RegistryValueData contains "GoogleUpdater" or RegistryValueData contains "MicrosoftEdgeUpdate")))

// ===== win_browser_script_file_drop.yml (-p microsoft_365_defender)
DeviceFileEvents
| where ((InitiatingProcessFolderPath endswith "\\chrome.exe" or InitiatingProcessFolderPath endswith "\\msedge.exe" or InitiatingProcessFolderPath endswith "\\brave.exe" or InitiatingProcessFolderPath endswith "\\opera.exe" or InitiatingProcessFolderPath endswith "\\vivaldi.exe") and (FolderPath endswith ".hta" or FolderPath endswith ".vbs" or FolderPath endswith ".vbe" or FolderPath endswith ".js" or FolderPath endswith ".jse" or FolderPath endswith ".wsf" or FolderPath endswith ".ps1" or FolderPath endswith ".bat" or FolderPath endswith ".cmd" or FolderPath endswith ".scr" or FolderPath endswith ".lnk")) and (not((FolderPath contains "\\User Data\\" or FolderPath contains "\\Google\\Chrome\\Application\\" or FolderPath contains "\\Microsoft\\Edge\\Application\\")))

// ===== win_chromium_browser_suspicious_child.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\chrome.exe" or InitiatingProcessFolderPath endswith "\\msedge.exe" or InitiatingProcessFolderPath endswith "\\brave.exe" or InitiatingProcessFolderPath endswith "\\opera.exe" or InitiatingProcessFolderPath endswith "\\vivaldi.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\schtasks.exe" or FolderPath endswith "\\wmic.exe") and (not((FolderPath endswith "\\cmd.exe" and (ProcessCommandLine contains "chrome-extension://" and ProcessCommandLine contains "--parent-window="))))

