// ===== lnx_imagemagick_reads_rails_secrets.yml (pipeline: azure_monitor)
SecurityEvent
| where (NewProcessName endswith "/convert" or NewProcessName endswith "/magick" or NewProcessName endswith "/identify") and (ObjectName endswith "/config/master.key" or ObjectName endswith "/config/credentials.yml.enc" or ObjectName endswith "/config/secrets.yml" or ObjectName endswith "/config/database.yml" or ObjectName endswith "/config/storage.yml" or ObjectName endswith "/.env" or ObjectName endswith "/proc/self/environ")

// ===== lnx_imagemagick_writes_sensitive_path.yml (pipeline: azure_monitor)
SecurityEvent
| where (NewProcessName endswith "/convert" or NewProcessName endswith "/magick" or NewProcessName endswith "/identify" or NewProcessName endswith "/mogrify") and ((ObjectName startswith "/etc/cron" or ObjectName startswith "/var/spool/cron" or ObjectName startswith "/var/www/" or ObjectName startswith "/etc/ld.so.preload") or (ObjectName contains "/.ssh/" or ObjectName contains "/config/" or ObjectName contains "/public/" or ObjectName contains "/app/") or (ObjectName endswith ".rb" or ObjectName endswith ".erb" or ObjectName endswith "/.bashrc"))

// ===== lnx_ruby_or_imagemagick_spawns_shell.yml (pipeline: azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "/convert" or ParentProcessName endswith "/magick" or ParentProcessName endswith "/identify" or ParentProcessName endswith "/ruby" or ParentProcessName endswith "/puma" or ParentProcessName endswith "/unicorn") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/zsh" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget") and (not((CommandLine contains "bundle exec" or CommandLine contains "assets:precompile")))

// ===== lnx_ruby_spawns_imagemagick.yml (pipeline: azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "/ruby" or ParentProcessName endswith "/puma" or ParentProcessName endswith "/unicorn" or ParentProcessName endswith "/sidekiq") and (NewProcessName endswith "/convert" or NewProcessName endswith "/magick" or NewProcessName endswith "/identify" or NewProcessName endswith "/mogrify")

// ===== lnx_svg_msl_mvg_created_in_storage.yml (pipeline: azure_monitor)
SecurityEvent
| where ObjectName contains "/storage/" and (ObjectName endswith ".svg" or ObjectName endswith ".svgz" or ObjectName endswith ".msl" or ObjectName endswith ".mvg")

