// sigma convert -t kusto --without-pipeline, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_delete_wp_config.yml (--without-pipeline)
TargetFilename endswith "/wp-config.php"

// ===== lnx_proc_webserver_shell.yml (--without-pipeline)
((ParentImage endswith "/apache2" or ParentImage endswith "/httpd" or ParentImage endswith "/nginx" or ParentImage endswith "/php-fpm" or ParentImage endswith "/lsphp") or ParentImage matches regex "/php(-fpm)?[0-9.]*$") and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat")

// ===== proxy_wp_setup_config_request.yml (--without-pipeline)
''c-uri'' contains "/wp-admin/setup-config.php" or ''c-uri'' contains "/wp-admin/install.php"

// ===== web_wp_admin_ajax_nf_submit_query.yml (--without-pipeline)
'cs-method' =~ "POST" and 'cs-uri-stem' endswith "/wp-admin/admin-ajax.php" and 'cs-uri-query' contains "nf_ajax_submit"

// ===== web_wp_setup_config_request.yml (--without-pipeline)
''cs-uri-stem'' endswith "/wp-admin/setup-config.php" or ''cs-uri-stem'' endswith "/wp-admin/install.php"

// ===== win_file_delete_wp_config.yml (--without-pipeline)
TargetFilename endswith "\\wp-config.php"

