// sigma convert -t kusto -p azure_monitor, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_delete_wp_config.yml (-p azure_monitor)
SecurityEvent
| where ObjectName endswith "/wp-config.php"

// ===== lnx_proc_webserver_shell.yml (-p azure_monitor)
SecurityEvent
| where ((ParentProcessName endswith "/apache2" or ParentProcessName endswith "/httpd" or ParentProcessName endswith "/nginx" or ParentProcessName endswith "/php-fpm" or ParentProcessName endswith "/lsphp") or ParentProcessName matches regex "/php(-fpm)?[0-9.]*$") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat")

// ===== proxy_wp_setup_config_request.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_wp_admin_ajax_nf_submit_query.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_wp_setup_config_request.yml (-p azure_monitor)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== win_file_delete_wp_config.yml (-p azure_monitor)
SecurityEvent
| where ObjectName endswith "\\wp-config.php"

