// sigma convert -t kusto -p microsoft_xdr, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_delete_wp_config.yml (-p microsoft_xdr)
DeviceFileEvents
| where FolderPath endswith "/wp-config.php"

// ===== lnx_proc_webserver_shell.yml (-p microsoft_xdr)
DeviceProcessEvents
| where ((InitiatingProcessFolderPath endswith "/apache2" or InitiatingProcessFolderPath endswith "/httpd" or InitiatingProcessFolderPath endswith "/nginx" or InitiatingProcessFolderPath endswith "/php-fpm" or InitiatingProcessFolderPath endswith "/lsphp") or InitiatingProcessFolderPath matches regex "/php(-fpm)?[0-9.]*$") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat")

// ===== proxy_wp_setup_config_request.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_wp_admin_ajax_nf_submit_query.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_wp_setup_config_request.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== win_file_delete_wp_config.yml (-p microsoft_xdr)
DeviceFileEvents
| where FolderPath endswith "\\wp-config.php"

