// sigma convert -t kusto -p azure_monitor, generated 10 Nov 2026. NOT run against a live tenant. See README for known gaps.
// ===== win_net_office_outbound_smb_public.yml (-p azure_monitor)
SecurityEvent
| where (NewProcessName endswith "\\OUTLOOK.EXE" or NewProcessName endswith "\\WINWORD.EXE" or NewProcessName endswith "\\EXCEL.EXE" or NewProcessName endswith "\\POWERPNT.EXE" or NewProcessName endswith "\\ONENOTE.EXE" or NewProcessName endswith "\\MSACCESS.EXE" or NewProcessName endswith "\\MSPUB.EXE" or NewProcessName endswith "\\VISIO.EXE") and (DestinationPort in~ ("445", "139")) and (not((ipv4_is_in_range(DestinationIp, "10.0.0.0/8") or ipv4_is_in_range(DestinationIp, "172.16.0.0/12") or ipv4_is_in_range(DestinationIp, "192.168.0.0/16") or ipv4_is_in_range(DestinationIp, "127.0.0.0/8") or ipv4_is_in_range(DestinationIp, "169.254.0.0/16"))))

// ===== win_proc_lsass_dsamain_child.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\lsass.exe" or ParentProcessName endswith "\\dsamain.exe") and (not((NewProcessName endswith "\\WerFault.exe" or NewProcessName endswith "\\WerFaultSecure.exe")))

// ===== win_proc_webdav_davsetcookie.yml (-p azure_monitor)
SecurityEvent
| where NewProcessName endswith "\\rundll32.exe" and (CommandLine contains "davclnt.dll" and CommandLine contains "DavSetCookie")

