// sigma convert -t kusto -p sentinel_asim, generated 10 Nov 2026. NOT run against a live tenant. See README for known gaps.
// ===== win_net_office_outbound_smb_public.yml (-p sentinel_asim)
imNetworkSession
| where ((SrcProcessName endswith "\\OUTLOOK.EXE" or SrcProcessName endswith "\\WINWORD.EXE" or SrcProcessName endswith "\\EXCEL.EXE" or SrcProcessName endswith "\\POWERPNT.EXE" or SrcProcessName endswith "\\ONENOTE.EXE" or SrcProcessName endswith "\\MSACCESS.EXE" or SrcProcessName endswith "\\MSPUB.EXE" or SrcProcessName endswith "\\VISIO.EXE") or (DstProcessName endswith "\\OUTLOOK.EXE" or DstProcessName endswith "\\WINWORD.EXE" or DstProcessName endswith "\\EXCEL.EXE" or DstProcessName endswith "\\POWERPNT.EXE" or DstProcessName endswith "\\ONENOTE.EXE" or DstProcessName endswith "\\MSACCESS.EXE" or DstProcessName endswith "\\MSPUB.EXE" or DstProcessName endswith "\\VISIO.EXE")) and (DstPortNumber in~ ("445", "139")) and (not((ipv4_is_in_range(DstIpAddr, "10.0.0.0/8") or ipv4_is_in_range(DstIpAddr, "172.16.0.0/12") or ipv4_is_in_range(DstIpAddr, "192.168.0.0/16") or ipv4_is_in_range(DstIpAddr, "127.0.0.0/8") or ipv4_is_in_range(DstIpAddr, "169.254.0.0/16"))))

// ===== win_proc_lsass_dsamain_child.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\lsass.exe" or ParentProcessName endswith "\\dsamain.exe") or (ActingProcessName endswith "\\lsass.exe" or ActingProcessName endswith "\\dsamain.exe")) and (not((TargetProcessName endswith "\\WerFault.exe" or TargetProcessName endswith "\\WerFaultSecure.exe")))

// ===== win_proc_webdav_davsetcookie.yml (-p sentinel_asim)
imProcessCreate
| where TargetProcessName endswith "\\rundll32.exe" and (TargetProcessCommandLine contains "davclnt.dll" and TargetProcessCommandLine contains "DavSetCookie")

