// sigma convert -t kusto -p microsoft_xdr, generated 12 Nov 2026. NOT run against a live tenant.
// ===== aws_cloudtrail_wfx_session_persistence.yml (-p microsoft_xdr): DOCUMENTED GAP, no AWS CloudTrail table in this pipeline; use KQL Q3 and Q3b

// ===== aws_cloudtrail_wfx_session_start.yml (-p microsoft_xdr): DOCUMENTED GAP, no AWS CloudTrail table in this pipeline; use KQL Q3 and Q3b

// ===== file_event_lnx_ci_helper_script.yml (-p microsoft_xdr)
DeviceFileEvents
| where FolderPath matches regex "/\\.ci-[a-z0-9]{6}\\.sh$"

// ===== file_event_lnx_wfx_staging_paths.yml (-p microsoft_xdr)
DeviceFileEvents
| where FolderPath matches regex "/\\.wfx-[0-9]+/" or FolderPath matches regex "/tmp/wfx-scan-[0-9]+/" or FolderPath matches regex "/wfx-[0-9]+\\.tgz$"

// ===== net_connection_wfx_exfil_servers.yml (-p microsoft_xdr)
DeviceNetworkEvents
| where RemoteIP in~ ("194.150.166.244", "18.143.168.96", "153.75.82.159")

// ===== proc_creation_lnx_npm_postinstall_ci_helper.yml (-p microsoft_xdr)
DeviceProcessEvents
| where ProcessCommandLine matches regex "\\.ci-[a-z0-9]{6}\\.sh"

