// ===== lnx_ncentral_nable_shell.yml (azure_monitor)
SecurityEvent
| where SubjectUserName =~ "nable" and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat" or NewProcessName endswith "/base64" or NewProcessName endswith "/sudo" or NewProcessName endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (azure_monitor)
SecurityEvent
| where ObjectName startswith "/opt/nable/webapps/" and ((ObjectName endswith ".jsp" or ObjectName endswith ".jspx" or ObjectName endswith ".war" or ObjectName endswith ".class" or ObjectName endswith ".sh") or ObjectName contains "/applianceLog/")
// ===== web_ncentral_appliancelog_request.yml (azure_monitor)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_ui_soap.yml (azure_monitor)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== win_ncentral_agent_script_child.yml (azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\msiexec.exe" or NewProcessName endswith "\\curl.exe" or NewProcessName endswith "\\wmic.exe")
// ===== win_ncentral_agent_user_add.yml (azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and ((CommandLine contains "net" and CommandLine contains " user " and CommandLine contains "/add") or CommandLine contains "New-LocalUser" or (CommandLine contains "DownloadString" or CommandLine contains "DownloadFile" or CommandLine contains "Invoke-WebRequest" or CommandLine contains "Start-BitsTransfer" or CommandLine contains "-urlcache"))
