// sigma convert -t kusto -p azure_monitor, generated 11 Nov 2026. NOT run against a live tenant.
// ===== dns_query_win_screenconnect_campaign_domains.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== file_event_win_screenconnect_campaign_filenames.yml (-p azure_monitor)
SecurityEvent
| where ObjectName endswith "\\Panel-Lateral.ps1" or ObjectName endswith "\\runnew.cmd" or ObjectName endswith "\\ToolboxRelayUploader.exe" or ObjectName endswith "\\Run-Lateral-Full.bat"

// ===== net_connection_win_screenconnect_campaign_ips.yml (-p azure_monitor)
SecurityEvent
| where DestinationIp in~ ("185.99.255.28", "155.94.150.39")

// ===== proc_creation_win_screenconnect_campaign_installer_ioc.yml (-p azure_monitor)
SecurityEvent
| where CommandLine contains "&c=Exploited" or (CommandLine contains "2588ef5c15954b10" or CommandLine contains "ed630cc2c873b091" or CommandLine contains "newnewnew.gotdns.org" or CommandLine contains "soxnewwork.homedns.org" or CommandLine contains "cdn007-digitaldownloads.com" or CommandLine contains "sc.payproofkit.com" or CommandLine contains "ns.mo7sen.dev" or CommandLine contains "/EadF.php")

// ===== proc_creation_win_screenconnect_client_spawns_shell.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\ScreenConnect.ClientService.exe" or ParentProcessName endswith "\\ScreenConnect.WindowsClient.exe") and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe")

// ===== registry_set_win_screenconnect_client_service_imagepath.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== win_system_screenconnect_client_service_installed.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

