// ===== file_event_lnx_ncentral_xvd_artifacts.yml (no_pipeline)
TargetFilename endswith "/xvd.service" or (TargetFilename startswith "/tmp/.xvd" or TargetFilename startswith "/var/tmp/.xvd")
// ===== lnx_ncentral_nable_shell.yml (no_pipeline)
User =~ "nable" and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/python3" or Image endswith "/perl" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat" or Image endswith "/base64" or Image endswith "/sudo" or Image endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (no_pipeline)
TargetFilename startswith "/opt/nable/webapps/" and ((TargetFilename endswith ".jsp" or TargetFilename endswith ".jspx" or TargetFilename endswith ".war" or TargetFilename endswith ".class" or TargetFilename endswith ".sh") or TargetFilename contains "/applianceLog/")
// ===== net_ncentral_press_ioc_ip.yml (no_pipeline)
DestinationIp =~ "157.20.241.16" or SourceIp =~ "157.20.241.16"
// ===== proc_creation_lnx_ncentral_press_ioc_download.yml (no_pipeline)
(Image endswith "/curl" or Image endswith "/wget" or Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash") and CommandLine contains "157.20.241.16"
// ===== proc_creation_lnx_ncentral_xvd_or_miner.yml (no_pipeline)
(Image startswith "/tmp/.xvd" or Image startswith "/var/tmp/.xvd") or (CommandLine contains "xvd.service" or CommandLine contains "/tmp/.xvd" or CommandLine contains "/var/tmp/.xvd") or Image endswith "/xmrig" or (CommandLine contains "stratum+tcp://" or CommandLine contains "stratum+ssl://" or CommandLine contains "stratum+tls://" or CommandLine contains "--donate-level" or CommandLine contains "--cpu-max-threads-hint")
// ===== web_ncentral_appliancelog_request.yml (no_pipeline)
'cs-uri-stem' contains "/applianceLog/"
// ===== web_ncentral_legacy_soap_ei.yml (no_pipeline)
'cs-uri-stem' endswith "/dms/services/ServerEI"
// ===== web_ncentral_serverui_jline.yml (no_pipeline)
"jline.internal.TerminalLineSettings"
// ===== web_ncentral_serverui_v1_request.yml (no_pipeline)
'cs-uri-stem' endswith "/dms/services/ServerUI"
// ===== web_ncentral_ui_soap.yml (no_pipeline)
''cs-uri-stem'' endswith "/dms/services/ServerUI" or ''cs-uri-stem'' endswith "/dms2/services2/ServerUI2"
// ===== win_ncentral_agent_script_child.yml (no_pipeline)
(ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\mshta.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\msiexec.exe" or Image endswith "\\curl.exe" or Image endswith "\\wmic.exe")
// ===== win_ncentral_agent_system_shell_suspicious.yml (no_pipeline)
(ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe") and (CommandLine contains "http://" or CommandLine contains "https://" or CommandLine contains "DownloadString" or CommandLine contains "DownloadFile" or CommandLine contains "Invoke-WebRequest" or CommandLine contains "FromBase64String" or CommandLine contains " -enc " or CommandLine contains " -EncodedCommand " or CommandLine contains "net user " or CommandLine contains "New-LocalUser" or CommandLine contains "localgroup administrators" or CommandLine contains "Set-MpPreference" or CommandLine contains "Add-MpPreference" or CommandLine contains "vssadmin" or CommandLine contains "wevtutil cl" or CommandLine contains "certutil" or CommandLine contains "bitsadmin")
// ===== win_ncentral_agent_user_add.yml (no_pipeline)
(ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and ((CommandLine contains "net" and CommandLine contains " user " and CommandLine contains "/add") or CommandLine contains "New-LocalUser" or (CommandLine contains "DownloadString" or CommandLine contains "DownloadFile" or CommandLine contains "Invoke-WebRequest" or CommandLine contains "Start-BitsTransfer" or CommandLine contains "-urlcache"))
