// ===== lnx_sap_gateway_acl_file_change.yml (-p microsoft_365_defender)
DeviceFileEvents
| where FolderPath endswith "/secinfo" or FolderPath endswith "/reginfo" or FolderPath endswith "/prxyinfo"

// ===== lnx_sap_kernel_process_file_write.yml (-p microsoft_365_defender)
DeviceFileEvents
| where (InitiatingProcessFolderPath endswith "/disp+work" or InitiatingProcessFolderPath endswith "/sapwebdisp" or InitiatingProcessFolderPath endswith "/icman" or InitiatingProcessFolderPath endswith "/gwrd" or InitiatingProcessFolderPath endswith "/jstart") and ((FolderPath endswith ".sh" or FolderPath endswith ".jsp" or FolderPath endswith ".so" or FolderPath endswith ".py" or FolderPath endswith "/authorized_keys") or (FolderPath contains "/etc/cron" or FolderPath contains "/var/spool/cron" or FolderPath contains "/.ssh/"))

// ===== lnx_sap_kernel_process_shell.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "/disp+work" or InitiatingProcessFolderPath endswith "/sapwebdisp" or InitiatingProcessFolderPath endswith "/icman" or InitiatingProcessFolderPath endswith "/gwrd" or InitiatingProcessFolderPath endswith "/jstart") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/ksh" or FolderPath endswith "/zsh" or FolderPath endswith "/python" or FolderPath endswith "/python3" or FolderPath endswith "/perl" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/busybox" or FolderPath endswith "/base64")

// ===== win_sap_kernel_process_shell.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "\\disp+work.exe" or InitiatingProcessFolderPath endswith "\\sapwebdisp.exe" or InitiatingProcessFolderPath endswith "\\icman.exe" or InitiatingProcessFolderPath endswith "\\gwrd.exe" or InitiatingProcessFolderPath endswith "\\jstart.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\whoami.exe")

