// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_chrome_spawn_shell.yml (--without-pipeline)
(ParentImage endswith "/opt/google/chrome/chrome" or ParentImage endswith "/chromium" or ParentImage endswith "/chromium-browser" or ParentImage endswith "/microsoft-edge") and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/zsh" or Image endswith "/python3" or Image endswith "/perl" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc") and (not((CommandLine contains "xdg-settings" or CommandLine contains "xdg-open" or CommandLine contains "xdg-mime")))

// ===== macos_chrome_spawn_shell.yml (--without-pipeline)
ParentImage contains "/Google Chrome.app/" and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/zsh" or Image endswith "/osascript" or Image endswith "/python3" or Image endswith "/perl" or Image endswith "/curl") and (not((CommandLine contains "GoogleUpdater" or CommandLine contains "GoogleSoftwareUpdate" or CommandLine contains "ksadmin")))

// ===== win_browser_run_key_persistence.yml (--without-pipeline)
((Image endswith "\\chrome.exe" or Image endswith "\\msedge.exe" or Image endswith "\\brave.exe" or Image endswith "\\opera.exe" or Image endswith "\\vivaldi.exe") and TargetObject contains "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") and (not((Details contains "\\Google\\Chrome\\Application\\chrome.exe" or Details contains "\\Microsoft\\Edge\\Application\\msedge.exe" or Details contains "GoogleUpdater" or Details contains "MicrosoftEdgeUpdate")))

// ===== win_browser_script_file_drop.yml (--without-pipeline)
((Image endswith "\\chrome.exe" or Image endswith "\\msedge.exe" or Image endswith "\\brave.exe" or Image endswith "\\opera.exe" or Image endswith "\\vivaldi.exe") and (TargetFilename endswith ".hta" or TargetFilename endswith ".vbs" or TargetFilename endswith ".vbe" or TargetFilename endswith ".js" or TargetFilename endswith ".jse" or TargetFilename endswith ".wsf" or TargetFilename endswith ".ps1" or TargetFilename endswith ".bat" or TargetFilename endswith ".cmd" or TargetFilename endswith ".scr" or TargetFilename endswith ".lnk")) and (not((TargetFilename contains "\\User Data\\" or TargetFilename contains "\\Google\\Chrome\\Application\\" or TargetFilename contains "\\Microsoft\\Edge\\Application\\")))

// ===== win_chromium_browser_suspicious_child.yml (--without-pipeline)
(ParentImage endswith "\\chrome.exe" or ParentImage endswith "\\msedge.exe" or ParentImage endswith "\\brave.exe" or ParentImage endswith "\\opera.exe" or ParentImage endswith "\\vivaldi.exe") and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\mshta.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\schtasks.exe" or Image endswith "\\wmic.exe") and (not((Image endswith "\\cmd.exe" and (CommandLine contains "chrome-extension://" and CommandLine contains "--parent-window="))))

