// sigma convert -t kusto -p azure_monitor, generated 12 Nov 2026. NOT run against a live tenant.
// ===== aws_cloudtrail_wfx_session_persistence.yml (-p azure_monitor): DOCUMENTED GAP, no AWS CloudTrail table in this pipeline; use KQL Q3 and Q3b

// ===== aws_cloudtrail_wfx_session_start.yml (-p azure_monitor): DOCUMENTED GAP, no AWS CloudTrail table in this pipeline; use KQL Q3 and Q3b

// ===== file_event_lnx_ci_helper_script.yml (-p azure_monitor)
SecurityEvent
| where ObjectName matches regex "/\\.ci-[a-z0-9]{6}\\.sh$"

// ===== file_event_lnx_wfx_staging_paths.yml (-p azure_monitor)
SecurityEvent
| where ObjectName matches regex "/\\.wfx-[0-9]+/" or ObjectName matches regex "/tmp/wfx-scan-[0-9]+/" or ObjectName matches regex "/wfx-[0-9]+\\.tgz$"

// ===== net_connection_wfx_exfil_servers.yml (-p azure_monitor)
SecurityEvent
| where DestinationIp in~ ("194.150.166.244", "18.143.168.96", "153.75.82.159")

// ===== proc_creation_lnx_npm_postinstall_ci_helper.yml (-p azure_monitor)
SecurityEvent
| where CommandLine matches regex "\\.ci-[a-z0-9]{6}\\.sh"

