// ===== lnx_ncentral_nable_shell.yml (microsoft_xdr)
DeviceProcessEvents
| where AccountName =~ "nable" and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/python3" or FolderPath endswith "/perl" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/base64" or FolderPath endswith "/sudo" or FolderPath endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (microsoft_xdr)
DeviceFileEvents
| where FolderPath startswith "/opt/nable/webapps/" and ((FolderPath endswith ".jsp" or FolderPath endswith ".jspx" or FolderPath endswith ".war" or FolderPath endswith ".class" or FolderPath endswith ".sh") or FolderPath contains "/applianceLog/")
// ===== web_ncentral_appliancelog_request.yml (microsoft_xdr)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== web_ncentral_ui_soap.yml (microsoft_xdr)
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
// ===== win_ncentral_agent_script_child.yml (microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\msiexec.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\wmic.exe")
// ===== win_ncentral_agent_user_add.yml (microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or InitiatingProcessFolderPath endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and ((ProcessCommandLine contains "net" and ProcessCommandLine contains " user " and ProcessCommandLine contains "/add") or ProcessCommandLine contains "New-LocalUser" or (ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "DownloadFile" or ProcessCommandLine contains "Invoke-WebRequest" or ProcessCommandLine contains "Start-BitsTransfer" or ProcessCommandLine contains "-urlcache"))
