// ===== lnx_ncentral_nable_shell.yml (sentinel_asim)
imProcessCreate
| where TargetUsername =~ "nable" and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat" or TargetProcessName endswith "/base64" or TargetProcessName endswith "/sudo" or TargetProcessName endswith "/crontab")
// ===== lnx_ncentral_webapp_file_write.yml (sentinel_asim)
imFileEvent
| where TargetFileName startswith "/opt/nable/webapps/" and ((TargetFileName endswith ".jsp" or TargetFileName endswith ".jspx" or TargetFileName endswith ".war" or TargetFileName endswith ".class" or TargetFileName endswith ".sh") or TargetFileName contains "/applianceLog/")
// ===== web_ncentral_appliancelog_request.yml (sentinel_asim)
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in th
// ===== web_ncentral_ui_soap.yml (sentinel_asim)
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in th
// ===== win_ncentral_agent_script_child.yml (sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") or (ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe")) and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe" or TargetProcessName endswith "\\msiexec.exe" or TargetProcessName endswith "\\curl.exe" or TargetProcessName endswith "\\wmic.exe")
// ===== win_ncentral_agent_user_add.yml (sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ParentProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe") or (ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\agent.exe" or ActingProcessName endswith "\\N-able Technologies\\Windows Agent\\bin\\AgentMaint.exe")) and ((TargetProcessCommandLine contains "net" and TargetProcessCommandLine contains " user " and TargetProcessCommandLine contains "/add") or TargetProcessCommandLine contains "New-LocalUser" or (TargetProcessCommandLine contains "DownloadString" or TargetProcessCommandLine contains "DownloadFile" or TargetProcessCommandLine contains "Invoke-WebRequest" or TargetProcessCommandLine contains "Start-BitsTransfer" or TargetProcessCommandLine contains "-urlcache"))
