// sigma convert -t kusto --without-pipeline, generated 11 Nov 2026. NOT run against a live tenant.
// ===== dns_query_win_screenconnect_campaign_domains.yml (--without-pipeline)
QueryName endswith "newnewnew.gotdns.org" or QueryName endswith "soxnewwork.homedns.org" or QueryName endswith "cdn007-digitaldownloads.com" or QueryName endswith "sc.payproofkit.com" or QueryName endswith "ns.mo7sen.dev"

// ===== file_event_win_screenconnect_campaign_filenames.yml (--without-pipeline)
TargetFilename endswith "\\Panel-Lateral.ps1" or TargetFilename endswith "\\runnew.cmd" or TargetFilename endswith "\\ToolboxRelayUploader.exe" or TargetFilename endswith "\\Run-Lateral-Full.bat"

// ===== net_connection_win_screenconnect_campaign_ips.yml (--without-pipeline)
DestinationIp in~ ("185.99.255.28", "155.94.150.39")

// ===== proc_creation_win_screenconnect_campaign_installer_ioc.yml (--without-pipeline)
CommandLine contains "&c=Exploited" or (CommandLine contains "2588ef5c15954b10" or CommandLine contains "ed630cc2c873b091" or CommandLine contains "newnewnew.gotdns.org" or CommandLine contains "soxnewwork.homedns.org" or CommandLine contains "cdn007-digitaldownloads.com" or CommandLine contains "sc.payproofkit.com" or CommandLine contains "ns.mo7sen.dev" or CommandLine contains "/EadF.php")

// ===== proc_creation_win_screenconnect_client_spawns_shell.yml (--without-pipeline)
(ParentImage endswith "\\ScreenConnect.ClientService.exe" or ParentImage endswith "\\ScreenConnect.WindowsClient.exe") and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\mshta.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe")

// ===== registry_set_win_screenconnect_client_service_imagepath.yml (--without-pipeline)
(TargetObject contains "\\Services\\ScreenConnect Client (" and TargetObject endswith "\\ImagePath") and (not(Details contains "h=REPLACE-WITH-YOUR-RELAY-HOST&"))

// ===== win_system_screenconnect_client_service_installed.yml (--without-pipeline)
(Provider_Name =~ "Service Control Manager" and EventID == 7045 and ServiceName startswith "ScreenConnect Client (") and (not(ImagePath contains "h=REPLACE-WITH-YOUR-RELAY-HOST&"))

