// lnx_auditd_authorized_keys_or_doas_change.yml
SecurityEvent
| where ObjectName in~ ("/etc/doas.conf", "/etc/sudoers") or ObjectName endswith "/.ssh/authorized_keys" or ObjectName endswith "/.ssh/authorized_keys2" or ObjectName startswith "/etc/doas.d/" or ObjectName startswith "/etc/sudoers.d/"

// lnx_doas_execution.yml
SecurityEvent
| where NewProcessName endswith "/doas"

// lnx_sshd_accepted_password_keyonly_account.yml
Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
  1) The value provided to processing pipeline's query_table parameter, if using a Python script.
  2) If the query_table is already set in the pipeline state, such as from a custom user-defined pipeline if using sigma-cli.

