// ===== lnx_imagemagick_reads_rails_secrets.yml (pipeline: microsoft_xdr)
DeviceFileEvents
| where (InitiatingProcessFolderPath endswith "/convert" or InitiatingProcessFolderPath endswith "/magick" or InitiatingProcessFolderPath endswith "/identify") and (FolderPath endswith "/config/master.key" or FolderPath endswith "/config/credentials.yml.enc" or FolderPath endswith "/config/secrets.yml" or FolderPath endswith "/config/database.yml" or FolderPath endswith "/config/storage.yml" or FolderPath endswith "/.env" or FolderPath endswith "/proc/self/environ")

// ===== lnx_imagemagick_writes_sensitive_path.yml (pipeline: microsoft_xdr)
DeviceFileEvents
| where (InitiatingProcessFolderPath endswith "/convert" or InitiatingProcessFolderPath endswith "/magick" or InitiatingProcessFolderPath endswith "/identify" or InitiatingProcessFolderPath endswith "/mogrify") and ((FolderPath startswith "/etc/cron" or FolderPath startswith "/var/spool/cron" or FolderPath startswith "/var/www/" or FolderPath startswith "/etc/ld.so.preload") or (FolderPath contains "/.ssh/" or FolderPath contains "/config/" or FolderPath contains "/public/" or FolderPath contains "/app/") or (FolderPath endswith ".rb" or FolderPath endswith ".erb" or FolderPath endswith "/.bashrc"))

// ===== lnx_ruby_or_imagemagick_spawns_shell.yml (pipeline: microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "/convert" or InitiatingProcessFolderPath endswith "/magick" or InitiatingProcessFolderPath endswith "/identify" or InitiatingProcessFolderPath endswith "/ruby" or InitiatingProcessFolderPath endswith "/puma" or InitiatingProcessFolderPath endswith "/unicorn") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/zsh" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/curl" or FolderPath endswith "/wget") and (not((ProcessCommandLine contains "bundle exec" or ProcessCommandLine contains "assets:precompile")))

// ===== lnx_ruby_spawns_imagemagick.yml (pipeline: microsoft_xdr)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "/ruby" or InitiatingProcessFolderPath endswith "/puma" or InitiatingProcessFolderPath endswith "/unicorn" or InitiatingProcessFolderPath endswith "/sidekiq") and (FolderPath endswith "/convert" or FolderPath endswith "/magick" or FolderPath endswith "/identify" or FolderPath endswith "/mogrify")

// ===== lnx_svg_msl_mvg_created_in_storage.yml (pipeline: microsoft_xdr)
DeviceFileEvents
| where FolderPath contains "/storage/" and (FolderPath endswith ".svg" or FolderPath endswith ".svgz" or FolderPath endswith ".msl" or FolderPath endswith ".mvg")

