// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant. See README for known gaps.
// ===== win_net_office_outbound_smb_public.yml (--without-pipeline)
(Image endswith "\\OUTLOOK.EXE" or Image endswith "\\WINWORD.EXE" or Image endswith "\\EXCEL.EXE" or Image endswith "\\POWERPNT.EXE" or Image endswith "\\ONENOTE.EXE" or Image endswith "\\MSACCESS.EXE" or Image endswith "\\MSPUB.EXE" or Image endswith "\\VISIO.EXE") and (DestinationPort in~ ("445", "139")) and (not((ipv4_is_in_range(DestinationIp, "10.0.0.0/8") or ipv4_is_in_range(DestinationIp, "172.16.0.0/12") or ipv4_is_in_range(DestinationIp, "192.168.0.0/16") or ipv4_is_in_range(DestinationIp, "127.0.0.0/8") or ipv4_is_in_range(DestinationIp, "169.254.0.0/16"))))

// ===== win_proc_lsass_dsamain_child.yml (--without-pipeline)
(ParentImage endswith "\\lsass.exe" or ParentImage endswith "\\dsamain.exe") and (not((Image endswith "\\WerFault.exe" or Image endswith "\\WerFaultSecure.exe")))

// ===== win_proc_webdav_davsetcookie.yml (--without-pipeline)
Image endswith "\\rundll32.exe" and (CommandLine contains "davclnt.dll" and CommandLine contains "DavSetCookie")

