// ===== lnx_sap_gateway_acl_file_change.yml (-p azure_monitor)
SecurityEvent
| where ObjectName endswith "/secinfo" or ObjectName endswith "/reginfo" or ObjectName endswith "/prxyinfo"

// ===== lnx_sap_kernel_process_file_write.yml (-p azure_monitor)
SecurityEvent
| where (NewProcessName endswith "/disp+work" or NewProcessName endswith "/sapwebdisp" or NewProcessName endswith "/icman" or NewProcessName endswith "/gwrd" or NewProcessName endswith "/jstart") and ((ObjectName endswith ".sh" or ObjectName endswith ".jsp" or ObjectName endswith ".so" or ObjectName endswith ".py" or ObjectName endswith "/authorized_keys") or (ObjectName contains "/etc/cron" or ObjectName contains "/var/spool/cron" or ObjectName contains "/.ssh/"))

// ===== lnx_sap_kernel_process_shell.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "/disp+work" or ParentProcessName endswith "/sapwebdisp" or ParentProcessName endswith "/icman" or ParentProcessName endswith "/gwrd" or ParentProcessName endswith "/jstart") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/ksh" or NewProcessName endswith "/zsh" or NewProcessName endswith "/python" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat" or NewProcessName endswith "/busybox" or NewProcessName endswith "/base64")

// ===== win_sap_kernel_process_shell.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName endswith "\\disp+work.exe" or ParentProcessName endswith "\\sapwebdisp.exe" or ParentProcessName endswith "\\icman.exe" or ParentProcessName endswith "\\gwrd.exe" or ParentProcessName endswith "\\jstart.exe") and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\whoami.exe")

