// sigma convert -t kusto -p microsoft_365_defender, generated 10 Nov 2026. NOT run against a live tenant.
// ===== win_epm_core_folder_rare_shell_child.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where InitiatingProcessFolderPath contains "\\LANDesk\\ManagementSuite\\" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\whoami.exe")

// ===== win_file_webshell_epm_core_folder.yml (-p microsoft_365_defender)
DeviceFileEvents
| where FolderPath contains "\\LANDesk\\ManagementSuite\\" and (FolderPath endswith ".aspx" or FolderPath endswith ".ashx" or FolderPath endswith ".asmx" or FolderPath endswith ".asp")

// ===== win_iis_w3wp_spawn_shell_epm_core.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where InitiatingProcessFolderPath endswith "\\w3wp.exe" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\whoami.exe")

// ===== win_mssql_spawn_shell.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where InitiatingProcessFolderPath endswith "\\sqlservr.exe" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\whoami.exe")

// ===== win_mssql_xp_cmdshell_enabled.yml (-p microsoft_365_defender)
// NOT CONVERTED: Unable to determine table name. This pipeline has no table for Windows Application log rules; use kql Q8 instead.

