// ===== lnx_imagemagick_reads_rails_secrets.yml (pipeline: sentinel_asim)
imFileEvent
| where (TargetFilePath endswith "/convert" or TargetFilePath endswith "/magick" or TargetFilePath endswith "/identify") and (TargetFileName endswith "/config/master.key" or TargetFileName endswith "/config/credentials.yml.enc" or TargetFileName endswith "/config/secrets.yml" or TargetFileName endswith "/config/database.yml" or TargetFileName endswith "/config/storage.yml" or TargetFileName endswith "/.env" or TargetFileName endswith "/proc/self/environ")

// ===== lnx_imagemagick_writes_sensitive_path.yml (pipeline: sentinel_asim)
imFileEvent
| where (TargetFilePath endswith "/convert" or TargetFilePath endswith "/magick" or TargetFilePath endswith "/identify" or TargetFilePath endswith "/mogrify") and ((TargetFileName startswith "/etc/cron" or TargetFileName startswith "/var/spool/cron" or TargetFileName startswith "/var/www/" or TargetFileName startswith "/etc/ld.so.preload") or (TargetFileName contains "/.ssh/" or TargetFileName contains "/config/" or TargetFileName contains "/public/" or TargetFileName contains "/app/") or (TargetFileName endswith ".rb" or TargetFileName endswith ".erb" or TargetFileName endswith "/.bashrc"))

// ===== lnx_ruby_or_imagemagick_spawns_shell.yml (pipeline: sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "/convert" or ParentProcessName endswith "/magick" or ParentProcessName endswith "/identify" or ParentProcessName endswith "/ruby" or ParentProcessName endswith "/puma" or ParentProcessName endswith "/unicorn") or (ActingProcessName endswith "/convert" or ActingProcessName endswith "/magick" or ActingProcessName endswith "/identify" or ActingProcessName endswith "/ruby" or ActingProcessName endswith "/puma" or ActingProcessName endswith "/unicorn")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/zsh" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget") and (not((TargetProcessCommandLine contains "bundle exec" or TargetProcessCommandLine contains "assets:precompile")))

// ===== lnx_ruby_spawns_imagemagick.yml (pipeline: sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "/ruby" or ParentProcessName endswith "/puma" or ParentProcessName endswith "/unicorn" or ParentProcessName endswith "/sidekiq") or (ActingProcessName endswith "/ruby" or ActingProcessName endswith "/puma" or ActingProcessName endswith "/unicorn" or ActingProcessName endswith "/sidekiq")) and (TargetProcessName endswith "/convert" or TargetProcessName endswith "/magick" or TargetProcessName endswith "/identify" or TargetProcessName endswith "/mogrify")

// ===== lnx_svg_msl_mvg_created_in_storage.yml (pipeline: sentinel_asim)
imFileEvent
| where TargetFileName contains "/storage/" and (TargetFileName endswith ".svg" or TargetFileName endswith ".svgz" or TargetFileName endswith ".msl" or TargetFileName endswith ".mvg")

