// ===== lnx_ncentral_nable_shell.yml (no_pipeline)
User =~ "nable" and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/python3" or Image endswith "/perl" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat" or Image endswith "/base64" or Image endswith "/sudo" or Image endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (no_pipeline)
TargetFilename startswith "/opt/nable/webapps/" and ((TargetFilename endswith ".jsp" or TargetFilename endswith ".jspx" or TargetFilename endswith ".war" or TargetFilename endswith ".class" or TargetFilename endswith ".sh") or TargetFilename contains "/applianceLog/")
// ===== web_ncentral_appliancelog_request.yml (no_pipeline)
'cs-uri-stem' contains "/applianceLog/"
// ===== web_ncentral_ui_soap.yml (no_pipeline)
''cs-uri-stem'' endswith "/dms/services/ServerUI" or ''cs-uri-stem'' endswith "/dms2/services2/ServerUI2"
// ===== win_ncentral_agent_script_child.yml (no_pipeline)
(ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\mshta.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\msiexec.exe" or Image endswith "\\curl.exe" or Image endswith "\\wmic.exe")
// ===== win_ncentral_agent_user_add.yml (no_pipeline)
(ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentImage endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") and ((CommandLine contains "net" and CommandLine contains " user " and CommandLine contains "/add") or CommandLine contains "New-LocalUser" or (CommandLine contains "DownloadString" or CommandLine contains "DownloadFile" or CommandLine contains "Invoke-WebRequest" or CommandLine contains "Start-BitsTransfer" or CommandLine contains "-urlcache"))
