// sigma convert -t kusto --without-pipeline (pySigma via sigma-cli 3.1.0 (online pypi.org: 4.0.0)), generated 2026-11-09. Not run on a live tenant.
// ===== freeswitch_api_proto_rejected.yml
"addressed to the 'api' chat proto"

// ===== freeswitch_sip_message_api_proto.yml
"MESSAGE sip:api+" or "MESSAGE sips:api+" or "To: <sip:api+" or "To: <sips:api+"

// ===== lnx_freeswitch_child_process.yml
ParentImage endswith "/freeswitch" and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/busybox" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat" or Image endswith "/python" or Image endswith "/python3" or Image endswith "/perl")

// ===== lnx_freeswitch_config_change.yml
TargetFilename contains "/freeswitch/" and (TargetFilename contains "/dialplan/" or TargetFilename contains "/directory/" or TargetFilename contains "/autoload_configs/" or TargetFilename contains "/sip_profiles/")

// ===== lnx_freeswitch_outbound_non_sip.yml
(Image endswith "/freeswitch" and Initiated =~ "true") and (not((DestinationPort in~ ("5060", "5061", "5080", "5081", "8021"))))

