// ===== lnx_sap_gateway_acl_file_change.yml (--without-pipeline)
TargetFilename endswith "/secinfo" or TargetFilename endswith "/reginfo" or TargetFilename endswith "/prxyinfo"

// ===== lnx_sap_kernel_process_file_write.yml (--without-pipeline)
(Image endswith "/disp+work" or Image endswith "/sapwebdisp" or Image endswith "/icman" or Image endswith "/gwrd" or Image endswith "/jstart") and ((TargetFilename endswith ".sh" or TargetFilename endswith ".jsp" or TargetFilename endswith ".so" or TargetFilename endswith ".py" or TargetFilename endswith "/authorized_keys") or (TargetFilename contains "/etc/cron" or TargetFilename contains "/var/spool/cron" or TargetFilename contains "/.ssh/"))

// ===== lnx_sap_kernel_process_shell.yml (--without-pipeline)
(ParentImage endswith "/disp+work" or ParentImage endswith "/sapwebdisp" or ParentImage endswith "/icman" or ParentImage endswith "/gwrd" or ParentImage endswith "/jstart") and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/ksh" or Image endswith "/zsh" or Image endswith "/python" or Image endswith "/python3" or Image endswith "/perl" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat" or Image endswith "/busybox" or Image endswith "/base64")

// ===== win_sap_kernel_process_shell.yml (--without-pipeline)
(ParentImage endswith "\\disp+work.exe" or ParentImage endswith "\\sapwebdisp.exe" or ParentImage endswith "\\icman.exe" or ParentImage endswith "\\gwrd.exe" or ParentImage endswith "\\jstart.exe") and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\mshta.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\whoami.exe")

