// sigma convert -t kusto -p sentinel_asim, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_chrome_spawn_shell.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "/opt/google/chrome/chrome" or ParentProcessName endswith "/chromium" or ParentProcessName endswith "/chromium-browser" or ParentProcessName endswith "/microsoft-edge") or (ActingProcessName endswith "/opt/google/chrome/chrome" or ActingProcessName endswith "/chromium" or ActingProcessName endswith "/chromium-browser" or ActingProcessName endswith "/microsoft-edge")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/zsh" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc") and (not((TargetProcessCommandLine contains "xdg-settings" or TargetProcessCommandLine contains "xdg-open" or TargetProcessCommandLine contains "xdg-mime")))

// ===== macos_chrome_spawn_shell.yml (-p sentinel_asim)
imProcessCreate
| where (ParentProcessName contains "/Google Chrome.app/" or ActingProcessName contains "/Google Chrome.app/") and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/zsh" or TargetProcessName endswith "/osascript" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl" or TargetProcessName endswith "/curl") and (not((TargetProcessCommandLine contains "GoogleUpdater" or TargetProcessCommandLine contains "GoogleSoftwareUpdate" or TargetProcessCommandLine contains "ksadmin")))

// ===== win_browser_run_key_persistence.yml (-p sentinel_asim)
imRegistry
| where ((ActingProcessName endswith "\\chrome.exe" or ActingProcessName endswith "\\msedge.exe" or ActingProcessName endswith "\\brave.exe" or ActingProcessName endswith "\\opera.exe" or ActingProcessName endswith "\\vivaldi.exe") and RegistryKey contains "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") and (not((RegistryValueData contains "\\Google\\Chrome\\Application\\chrome.exe" or RegistryValueData contains "\\Microsoft\\Edge\\Application\\msedge.exe" or RegistryValueData contains "GoogleUpdater" or RegistryValueData contains "MicrosoftEdgeUpdate")))

// ===== win_browser_script_file_drop.yml (-p sentinel_asim)
imFileEvent
| where ((TargetFilePath endswith "\\chrome.exe" or TargetFilePath endswith "\\msedge.exe" or TargetFilePath endswith "\\brave.exe" or TargetFilePath endswith "\\opera.exe" or TargetFilePath endswith "\\vivaldi.exe") and (TargetFileName endswith ".hta" or TargetFileName endswith ".vbs" or TargetFileName endswith ".vbe" or TargetFileName endswith ".js" or TargetFileName endswith ".jse" or TargetFileName endswith ".wsf" or TargetFileName endswith ".ps1" or TargetFileName endswith ".bat" or TargetFileName endswith ".cmd" or TargetFileName endswith ".scr" or TargetFileName endswith ".lnk")) and (not((TargetFileName contains "\\User Data\\" or TargetFileName contains "\\Google\\Chrome\\Application\\" or TargetFileName contains "\\Microsoft\\Edge\\Application\\")))

// ===== win_chromium_browser_suspicious_child.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\chrome.exe" or ParentProcessName endswith "\\msedge.exe" or ParentProcessName endswith "\\brave.exe" or ParentProcessName endswith "\\opera.exe" or ParentProcessName endswith "\\vivaldi.exe") or (ActingProcessName endswith "\\chrome.exe" or ActingProcessName endswith "\\msedge.exe" or ActingProcessName endswith "\\brave.exe" or ActingProcessName endswith "\\opera.exe" or ActingProcessName endswith "\\vivaldi.exe")) and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe" or TargetProcessName endswith "\\schtasks.exe" or TargetProcessName endswith "\\wmic.exe") and (not((TargetProcessName endswith "\\cmd.exe" and (TargetProcessCommandLine contains "chrome-extension://" and TargetProcessCommandLine contains "--parent-window="))))

