// sigma convert -t kusto -p microsoft_xdr, generated 11 Nov 2026. NOT run against a live tenant.
// ===== dns_query_win_screenconnect_campaign_domains.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== file_event_win_screenconnect_campaign_filenames.yml (-p microsoft_xdr)
DeviceFileEvents
| where FolderPath endswith "\\Panel-Lateral.ps1" or FolderPath endswith "\\runnew.cmd" or FolderPath endswith "\\ToolboxRelayUploader.exe" or FolderPath endswith "\\Run-Lateral-Full.bat"

// ===== net_connection_win_screenconnect_campaign_ips.yml (-p microsoft_xdr)
DeviceNetworkEvents
| where RemoteIP in~ ("185.99.255.28", "155.94.150.39")

// ===== proc_creation_win_screenconnect_campaign_installer_ioc.yml (-p microsoft_xdr)
DeviceProcessEvents
| where ProcessCommandLine contains "&c=Exploited" or (ProcessCommandLine contains "2588ef5c15954b10" or ProcessCommandLine contains "ed630cc2c873b091" or ProcessCommandLine contains "newnewnew.gotdns.org" or ProcessCommandLine contains "soxnewwork.homedns.org" or ProcessCommandLine contains "cdn007-digitaldownloads.com" or ProcessCommandLine contains "sc.payproofkit.com" or ProcessCommandLine contains "ns.mo7sen.dev" or ProcessCommandLine contains "/EadF.php")

// ===== proc_creation_win_screenconnect_client_spawns_shell.yml (-p microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\ScreenConnect.ClientService.exe" or InitiatingProcessFolderPath endswith "\\ScreenConnect.WindowsClient.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe")

// ===== registry_set_win_screenconnect_client_service_imagepath.yml (-p microsoft_xdr)
DeviceRegistryEvents
| where (RegistryKey contains "\\Services\\ScreenConnect Client (" and RegistryKey endswith "\\ImagePath") and (not(RegistryValueData contains "h=REPLACE-WITH-YOUR-RELAY-HOST&"))

// ===== win_system_screenconnect_client_service_installed.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

