// ===== file_event_lnx_ncentral_xvd_artifacts.yml (sentinel_asim)
imFileEvent
| where TargetFileName endswith "/xvd.service" or (TargetFileName startswith "/tmp/.xvd" or TargetFileName startswith "/var/tmp/.xvd")
// ===== lnx_ncentral_nable_shell.yml (sentinel_asim)
imProcessCreate
| where TargetUsername =~ "nable" and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat" or TargetProcessName endswith "/base64" or TargetProcessName endswith "/sudo" or TargetProcessName endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (sentinel_asim)
imFileEvent
| where TargetFileName startswith "/opt/nable/webapps/" and ((TargetFileName endswith ".jsp" or TargetFileName endswith ".jspx" or TargetFileName endswith ".war" or TargetFileName endswith ".class" or TargetFileName endswith ".sh") or TargetFileName contains "/applianceLog/")
// ===== net_ncentral_press_ioc_ip.yml (sentinel_asim)
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: SourceIp. Please use valid fields for the imNetworkSession table, or the following fields that have fieldmappings in this pipeline:
// ===== proc_creation_lnx_ncentral_press_ioc_download.yml (sentinel_asim)
imProcessCreate
| where (TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash") and TargetProcessCommandLine contains "157.20.241.16"
// ===== proc_creation_lnx_ncentral_xvd_or_miner.yml (sentinel_asim)
imProcessCreate
| where (TargetProcessName startswith "/tmp/.xvd" or TargetProcessName startswith "/var/tmp/.xvd") or (TargetProcessCommandLine contains "xvd.service" or TargetProcessCommandLine contains "/tmp/.xvd" or TargetProcessCommandLine contains "/var/tmp/.xvd") or TargetProcessName endswith "/xmrig" or (TargetProcessCommandLine contains "stratum+tcp://" or TargetProcessCommandLine contains "stratum+ssl://" or TargetProcessCommandLine contains "stratum+tls://" or TargetProcessCommandLine contains "--donate-level" or TargetProcessCommandLine contains "--cpu-max-threads-hint")
// ===== web_ncentral_appliancelog_request.yml (sentinel_asim)
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in this pipeline:
// ===== web_ncentral_legacy_soap_ei.yml (sentinel_asim)
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in this pipeline:
// ===== web_ncentral_serverui_jline.yml (sentinel_asim)
imWebSession
| where "jline.internal.TerminalLineSettings"
// ===== web_ncentral_serverui_v1_request.yml (sentinel_asim)
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in this pipeline:
// ===== web_ncentral_ui_soap.yml (sentinel_asim)
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in this pipeline:
// ===== win_ncentral_agent_script_child.yml (sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") or (ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe")) and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe" or TargetProcessName endswith "\\msiexec.exe" or TargetProcessName endswith "\\curl.exe" or TargetProcessName endswith "\\wmic.exe")
// ===== win_ncentral_agent_system_shell_suspicious.yml (sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") or (ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe")) and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe") and (TargetProcessCommandLine contains "http://" or TargetProcessCommandLine contains "https://" or TargetProcessCommandLine contains "DownloadString" or TargetProcessCommandLine contains "DownloadFile" or TargetProcessCommandLine contains "Invoke-WebRequest" or TargetProcessCommandLine contains "FromBase64String" or TargetProcessCommandLine contains " -enc " or TargetProcessCommandLine contains " -EncodedCommand " or TargetProcessCommandLine contains "net user " or TargetProcessCommandLine contains "New-LocalUser" or TargetProcessCommandLine contains "localgroup administrators" or TargetProcessCommandLine contains "Set-MpPreference" or TargetProcessCommandLine contains "Add-MpPreference" or TargetProcessCommandLine contains "vssadmin" or TargetProcessCommandLine contains "wevtutil cl" or TargetProcessCommandLine contains "certutil" or TargetProcessCommandLine contains "bitsadmin")
// ===== win_ncentral_agent_user_add.yml (sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") or (ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe")) and ((TargetProcessCommandLine contains "net" and TargetProcessCommandLine contains " user " and TargetProcessCommandLine contains "/add") or TargetProcessCommandLine contains "New-LocalUser" or (TargetProcessCommandLine contains "DownloadString" or TargetProcessCommandLine contains "DownloadFile" or TargetProcessCommandLine contains "Invoke-WebRequest" or TargetProcessCommandLine contains "Start-BitsTransfer" or TargetProcessCommandLine contains "-urlcache"))
