// ===== lnx_sap_gateway_acl_file_change.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName endswith "/secinfo" or TargetFileName endswith "/reginfo" or TargetFileName endswith "/prxyinfo"

// ===== lnx_sap_kernel_process_file_write.yml (-p sentinel_asim)
imFileEvent
| where (TargetFilePath endswith "/disp+work" or TargetFilePath endswith "/sapwebdisp" or TargetFilePath endswith "/icman" or TargetFilePath endswith "/gwrd" or TargetFilePath endswith "/jstart") and ((TargetFileName endswith ".sh" or TargetFileName endswith ".jsp" or TargetFileName endswith ".so" or TargetFileName endswith ".py" or TargetFileName endswith "/authorized_keys") or (TargetFileName contains "/etc/cron" or TargetFileName contains "/var/spool/cron" or TargetFileName contains "/.ssh/"))

// ===== lnx_sap_kernel_process_shell.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "/disp+work" or ParentProcessName endswith "/sapwebdisp" or ParentProcessName endswith "/icman" or ParentProcessName endswith "/gwrd" or ParentProcessName endswith "/jstart") or (ActingProcessName endswith "/disp+work" or ActingProcessName endswith "/sapwebdisp" or ActingProcessName endswith "/icman" or ActingProcessName endswith "/gwrd" or ActingProcessName endswith "/jstart")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/ksh" or TargetProcessName endswith "/zsh" or TargetProcessName endswith "/python" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat" or TargetProcessName endswith "/busybox" or TargetProcessName endswith "/base64")

// ===== win_sap_kernel_process_shell.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName endswith "\\disp+work.exe" or ParentProcessName endswith "\\sapwebdisp.exe" or ParentProcessName endswith "\\icman.exe" or ParentProcessName endswith "\\gwrd.exe" or ParentProcessName endswith "\\jstart.exe") or (ActingProcessName endswith "\\disp+work.exe" or ActingProcessName endswith "\\sapwebdisp.exe" or ActingProcessName endswith "\\icman.exe" or ActingProcessName endswith "\\gwrd.exe" or ActingProcessName endswith "\\jstart.exe")) and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe" or TargetProcessName endswith "\\whoami.exe")

