// sigma convert -t kusto -p sentinel_asim, generated 12 Nov 2026. NOT run against a live tenant.
// ===== aws_cloudtrail_wfx_session_persistence.yml (-p sentinel_asim): DOCUMENTED GAP, no AWS CloudTrail table in this pipeline; use KQL Q3 and Q3b

// ===== aws_cloudtrail_wfx_session_start.yml (-p sentinel_asim): DOCUMENTED GAP, no AWS CloudTrail table in this pipeline; use KQL Q3 and Q3b

// ===== file_event_lnx_ci_helper_script.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName matches regex "/\\.ci-[a-z0-9]{6}\\.sh$"

// ===== file_event_lnx_wfx_staging_paths.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName matches regex "/\\.wfx-[0-9]+/" or TargetFileName matches regex "/tmp/wfx-scan-[0-9]+/" or TargetFileName matches regex "/wfx-[0-9]+\\.tgz$"

// ===== net_connection_wfx_exfil_servers.yml (-p sentinel_asim)
imNetworkSession
| where DstIpAddr in~ ("194.150.166.244", "18.143.168.96", "153.75.82.159")

// ===== proc_creation_lnx_npm_postinstall_ci_helper.yml (-p sentinel_asim)
imProcessCreate
| where TargetProcessCommandLine matches regex "\\.ci-[a-z0-9]{6}\\.sh"

