// sigma convert -t kusto -p microsoft_365_defender, generated 10 Nov 2026. NOT run against a live tenant. See README for known gaps.
// ===== win_net_office_outbound_smb_public.yml (-p microsoft_365_defender)
DeviceNetworkEvents
| where (InitiatingProcessFolderPath endswith "\\OUTLOOK.EXE" or InitiatingProcessFolderPath endswith "\\WINWORD.EXE" or InitiatingProcessFolderPath endswith "\\EXCEL.EXE" or InitiatingProcessFolderPath endswith "\\POWERPNT.EXE" or InitiatingProcessFolderPath endswith "\\ONENOTE.EXE" or InitiatingProcessFolderPath endswith "\\MSACCESS.EXE" or InitiatingProcessFolderPath endswith "\\MSPUB.EXE" or InitiatingProcessFolderPath endswith "\\VISIO.EXE") and (RemotePort in~ ("445", "139")) and (not((ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16") or ipv4_is_in_range(RemoteIP, "127.0.0.0/8") or ipv4_is_in_range(RemoteIP, "169.254.0.0/16"))))

// ===== win_proc_lsass_dsamain_child.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\lsass.exe" or InitiatingProcessFolderPath endswith "\\dsamain.exe") and (not((FolderPath endswith "\\WerFault.exe" or FolderPath endswith "\\WerFaultSecure.exe")))

// ===== win_proc_webdav_davsetcookie.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where FolderPath endswith "\\rundll32.exe" and (ProcessCommandLine contains "davclnt.dll" and ProcessCommandLine contains "DavSetCookie")

