// sigma convert -t kusto --without-pipeline, generated 12 Nov 2026. NOT run against a live tenant.
// ===== aws_cloudtrail_wfx_session_persistence.yml (--without-pipeline)
(eventName in~ ("CreateAccessKey", "UpdateAssumeRolePolicy")) and 'userIdentity.arn' contains "/wfx-"

// ===== aws_cloudtrail_wfx_session_start.yml (--without-pipeline)
(eventName in~ ("AssumeRoleWithWebIdentity", "AssumeRole")) and 'requestParameters.roleSessionName' startswith "wfx-"

// ===== file_event_lnx_ci_helper_script.yml (--without-pipeline)
TargetFilename matches regex "/\\.ci-[a-z0-9]{6}\\.sh$"

// ===== file_event_lnx_wfx_staging_paths.yml (--without-pipeline)
TargetFilename matches regex "/\\.wfx-[0-9]+/" or TargetFilename matches regex "/tmp/wfx-scan-[0-9]+/" or TargetFilename matches regex "/wfx-[0-9]+\\.tgz$"

// ===== net_connection_wfx_exfil_servers.yml (--without-pipeline)
DestinationIp in~ ("194.150.166.244", "18.143.168.96", "153.75.82.159")

// ===== proc_creation_lnx_npm_postinstall_ci_helper.yml (--without-pipeline)
CommandLine matches regex "\\.ci-[a-z0-9]{6}\\.sh"

