// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant.
// ===== win_epm_core_folder_rare_shell_child.yml (--without-pipeline)
ParentImage contains "\\LANDesk\\ManagementSuite\\" and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\mshta.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\whoami.exe")

// ===== win_file_webshell_epm_core_folder.yml (--without-pipeline)
TargetFilename contains "\\LANDesk\\ManagementSuite\\" and (TargetFilename endswith ".aspx" or TargetFilename endswith ".ashx" or TargetFilename endswith ".asmx" or TargetFilename endswith ".asp")

// ===== win_iis_w3wp_spawn_shell_epm_core.yml (--without-pipeline)
ParentImage endswith "\\w3wp.exe" and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\mshta.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\whoami.exe")

// ===== win_mssql_spawn_shell.yml (--without-pipeline)
ParentImage endswith "\\sqlservr.exe" and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\mshta.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\curl.exe" or Image endswith "\\whoami.exe")

// ===== win_mssql_xp_cmdshell_enabled.yml (--without-pipeline)
Provider_Name contains "MSSQL" and EventID == 15457 and Data contains "xp_cmdshell"

