// lnx_auditd_authorized_keys_or_doas_change.yml
imFileEvent
| where TargetFileName in~ ("/etc/doas.conf", "/etc/sudoers") or TargetFileName endswith "/.ssh/authorized_keys" or TargetFileName endswith "/.ssh/authorized_keys2" or TargetFileName startswith "/etc/doas.d/" or TargetFileName startswith "/etc/sudoers.d/"

// lnx_doas_execution.yml
imProcessCreate
| where TargetProcessName endswith "/doas"

// lnx_sshd_accepted_password_keyonly_account.yml
Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
  1) The value provided to processing pipeline's query_table parameter, if using a Python script.
  2) If the query_table is already set in the pipeline state, such as from a custom user-defined pipeline if using sigma-cli.

