// ===== file_event_lnx_ncentral_xvd_artifacts.yml (microsoft_xdr)
DeviceFileEvents
| where FolderPath endswith "/xvd.service" or (FolderPath startswith "/tmp/.xvd" or FolderPath startswith "/var/tmp/.xvd")
// ===== lnx_ncentral_nable_shell.yml (microsoft_xdr)
DeviceProcessEvents
| where AccountName =~ "nable" and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/python3" or FolderPath endswith "/perl" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/base64" or FolderPath endswith "/sudo" or FolderPath endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (microsoft_xdr)
DeviceFileEvents
| where FolderPath startswith "/opt/nable/webapps/" and ((FolderPath endswith ".jsp" or FolderPath endswith ".jspx" or FolderPath endswith ".war" or FolderPath endswith ".class" or FolderPath endswith ".sh") or FolderPath contains "/applianceLog/")
// ===== net_ncentral_press_ioc_ip.yml (microsoft_xdr)
DeviceNetworkEvents
| where RemoteIP =~ "157.20.241.16" or LocalIP =~ "157.20.241.16"
// ===== proc_creation_lnx_ncentral_press_ioc_download.yml (microsoft_xdr)
DeviceProcessEvents
| where (FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash") and ProcessCommandLine contains "157.20.241.16"
// ===== proc_creation_lnx_ncentral_xvd_or_miner.yml (microsoft_xdr)
DeviceProcessEvents
| where (FolderPath startswith "/tmp/.xvd" or FolderPath startswith "/var/tmp/.xvd") or (ProcessCommandLine contains "xvd.service" or ProcessCommandLine contains "/tmp/.xvd" or ProcessCommandLine contains "/var/tmp/.xvd") or FolderPath endswith "/xmrig" or (ProcessCommandLine contains "stratum+tcp://" or ProcessCommandLine contains "stratum+ssl://" or ProcessCommandLine contains "stratum+tls://" or ProcessCommandLine contains "--donate-level" or ProcessCommandLine contains "--cpu-max-threads-hint")
// ===== web_ncentral_appliancelog_request.yml (microsoft_xdr)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_legacy_soap_ei.yml (microsoft_xdr)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_serverui_jline.yml (microsoft_xdr)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_serverui_v1_request.yml (microsoft_xdr)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_ui_soap.yml (microsoft_xdr)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== win_ncentral_agent_script_child.yml (microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\msiexec.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\wmic.exe")
// ===== win_ncentral_agent_system_shell_suspicious.yml (microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "http://" or ProcessCommandLine contains "https://" or ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "DownloadFile" or ProcessCommandLine contains "Invoke-WebRequest" or ProcessCommandLine contains "FromBase64String" or ProcessCommandLine contains " -enc " or ProcessCommandLine contains " -EncodedCommand " or ProcessCommandLine contains "net user " or ProcessCommandLine contains "New-LocalUser" or ProcessCommandLine contains "localgroup administrators" or ProcessCommandLine contains "Set-MpPreference" or ProcessCommandLine contains "Add-MpPreference" or ProcessCommandLine contains "vssadmin" or ProcessCommandLine contains "wevtutil cl" or ProcessCommandLine contains "certutil" or ProcessCommandLine contains "bitsadmin")
// ===== win_ncentral_agent_user_add.yml (microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and ((ProcessCommandLine contains "net" and ProcessCommandLine contains " user " and ProcessCommandLine contains "/add") or ProcessCommandLine contains "New-LocalUser" or (ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "DownloadFile" or ProcessCommandLine contains "Invoke-WebRequest" or ProcessCommandLine contains "Start-BitsTransfer" or ProcessCommandLine contains "-urlcache"))
