// ===== file_event_lnx_ncentral_xvd_artifacts.yml (azure_monitor)
SecurityEvent
| where ObjectName endswith "/xvd.service" or (ObjectName startswith "/tmp/.xvd" or ObjectName startswith "/var/tmp/.xvd")
// ===== lnx_ncentral_nable_shell.yml (azure_monitor)
SecurityEvent
| where SubjectUserName =~ "nable" and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat" or NewProcessName endswith "/base64" or NewProcessName endswith "/sudo" or NewProcessName endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (azure_monitor)
SecurityEvent
| where ObjectName startswith "/opt/nable/webapps/" and ((ObjectName endswith ".jsp" or ObjectName endswith ".jspx" or ObjectName endswith ".war" or ObjectName endswith ".class" or ObjectName endswith ".sh") or ObjectName contains "/applianceLog/")
// ===== net_ncentral_press_ioc_ip.yml (azure_monitor)
SecurityEvent
| where DestinationIp =~ "157.20.241.16" or IpAddress =~ "157.20.241.16"
// ===== proc_creation_lnx_ncentral_press_ioc_download.yml (azure_monitor)
SecurityEvent
| where (NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash") and CommandLine contains "157.20.241.16"
// ===== proc_creation_lnx_ncentral_xvd_or_miner.yml (azure_monitor)
SecurityEvent
| where (NewProcessName startswith "/tmp/.xvd" or NewProcessName startswith "/var/tmp/.xvd") or (CommandLine contains "xvd.service" or CommandLine contains "/tmp/.xvd" or CommandLine contains "/var/tmp/.xvd") or NewProcessName endswith "/xmrig" or (CommandLine contains "stratum+tcp://" or CommandLine contains "stratum+ssl://" or CommandLine contains "stratum+tls://" or CommandLine contains "--donate-level" or CommandLine contains "--cpu-max-threads-hint")
// ===== web_ncentral_appliancelog_request.yml (azure_monitor)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_legacy_soap_ei.yml (azure_monitor)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_serverui_jline.yml (azure_monitor)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_serverui_v1_request.yml (azure_monitor)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_ui_soap.yml (azure_monitor)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== win_ncentral_agent_script_child.yml (azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\msiexec.exe" or NewProcessName endswith "\\curl.exe" or NewProcessName endswith "\\wmic.exe")
// ===== win_ncentral_agent_system_shell_suspicious.yml (azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe") and (CommandLine contains "http://" or CommandLine contains "https://" or CommandLine contains "DownloadString" or CommandLine contains "DownloadFile" or CommandLine contains "Invoke-WebRequest" or CommandLine contains "FromBase64String" or CommandLine contains " -enc " or CommandLine contains " -EncodedCommand " or CommandLine contains "net user " or CommandLine contains "New-LocalUser" or CommandLine contains "localgroup administrators" or CommandLine contains "Set-MpPreference" or CommandLine contains "Add-MpPreference" or CommandLine contains "vssadmin" or CommandLine contains "wevtutil cl" or CommandLine contains "certutil" or CommandLine contains "bitsadmin")
// ===== win_ncentral_agent_user_add.yml (azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and ((CommandLine contains "net" and CommandLine contains " user " and CommandLine contains "/add") or CommandLine contains "New-LocalUser" or (CommandLine contains "DownloadString" or CommandLine contains "DownloadFile" or CommandLine contains "Invoke-WebRequest" or CommandLine contains "Start-BitsTransfer" or CommandLine contains "-urlcache"))
