// sigma convert -t kusto -p azure_monitor, generated 10 Nov 2026. NOT run against a live tenant.
// ===== win_epm_core_folder_rare_shell_child.yml (-p azure_monitor)
SecurityEvent
| where ParentProcessName contains "\\LANDesk\\ManagementSuite\\" and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\whoami.exe")

// ===== win_file_webshell_epm_core_folder.yml (-p azure_monitor)
SecurityEvent
| where ObjectName endswith "\\LANDesk\\ManagementSuite*" and (ObjectName endswith ".aspx" or ObjectName endswith ".ashx" or ObjectName endswith ".asmx" or ObjectName endswith ".asp")

// ===== win_iis_w3wp_spawn_shell_epm_core.yml (-p azure_monitor)
SecurityEvent
| where ParentProcessName endswith "\\w3wp.exe" and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\whoami.exe")

// ===== win_mssql_spawn_shell.yml (-p azure_monitor)
SecurityEvent
| where ParentProcessName endswith "\\sqlservr.exe" and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\curl.exe" or NewProcessName endswith "\\whoami.exe")

// ===== win_mssql_xp_cmdshell_enabled.yml (-p azure_monitor)
// NOT CONVERTED: Unable to determine table name. This pipeline has no table for Windows Application log rules; use kql Q8 instead.

