// sigma convert -t kusto -p sentinel_asim, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_delete_wp_config.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName endswith "/wp-config.php"

// ===== lnx_proc_webserver_shell.yml (-p sentinel_asim)
imProcessCreate
| where (((ParentProcessName endswith "/apache2" or ParentProcessName endswith "/httpd" or ParentProcessName endswith "/nginx" or ParentProcessName endswith "/php-fpm" or ParentProcessName endswith "/lsphp") or (ActingProcessName endswith "/apache2" or ActingProcessName endswith "/httpd" or ActingProcessName endswith "/nginx" or ActingProcessName endswith "/php-fpm" or ActingProcessName endswith "/lsphp")) or (ParentProcessName matches regex "/php(-fpm)?[0-9.]*$" or ActingProcessName matches regex "/php(-fpm)?[0-9.]*$")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat")

// ===== proxy_wp_setup_config_request.yml (-p sentinel_asim)
imWebSession
| where Url contains "/wp-admin/setup-config.php" or Url contains "/wp-admin/install.php"

// ===== web_wp_admin_ajax_nf_submit_query.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_wp_setup_config_request.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== win_file_delete_wp_config.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName endswith "\\wp-config.php"

