// sigma convert -t kusto -p sentinel_asim, generated 11 Nov 2026. NOT run against a live tenant.
// ===== dns_query_win_screenconnect_campaign_domains.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== file_event_win_screenconnect_campaign_filenames.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName endswith "\\Panel-Lateral.ps1" or TargetFileName endswith "\\runnew.cmd" or TargetFileName endswith "\\ToolboxRelayUploader.exe" or TargetFileName endswith "\\Run-Lateral-Full.bat"

// ===== net_connection_win_screenconnect_campaign_ips.yml (-p sentinel_asim)
imNetworkSession
| where DstIpAddr in~ ("185.99.255.28", "155.94.150.39")

// ===== proc_creation_win_screenconnect_campaign_installer_ioc.yml (-p sentinel_asim)
imProcessCreate
| where TargetProcessCommandLine contains "&c=Exploited" or (TargetProcessCommandLine contains "2588ef5c15954b10" or TargetProcessCommandLine contains "ed630cc2c873b091" or TargetProcessCommandLine contains "newnewnew.gotdns.org" or TargetProcessCommandLine contains "soxnewwork.homedns.org" or TargetProcessCommandLine contains "cdn007-digitaldownloads.com" or TargetProcessCommandLine contains "sc.payproofkit.com" or TargetProcessCommandLine contains "ns.mo7sen.dev" or TargetProcessCommandLine contains "/EadF.php")

// ===== proc_creation_win_screenconnect_client_spawns_shell.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\ScreenConnect.ClientService.exe" or ParentProcessName endswith "\\ScreenConnect.WindowsClient.exe") or (ActingProcessName endswith "\\ScreenConnect.ClientService.exe" or ActingProcessName endswith "\\ScreenConnect.WindowsClient.exe")) and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe")

// ===== registry_set_win_screenconnect_client_service_imagepath.yml (-p sentinel_asim)
imRegistry
| where (RegistryKey contains "\\Services\\ScreenConnect Client (" and RegistryKey endswith "\\ImagePath") and (not(RegistryValueData contains "h=REPLACE-WITH-YOUR-RELAY-HOST&"))

// ===== win_system_screenconnect_client_service_installed.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

