// sigma convert -t kusto -p azure_monitor, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_xo_vsa_2026_062_ustar_files.yml (-p azure_monitor)
SecurityEvent
| where ObjectName in~ ("/etc/cron.d/zz-ustar", "/etc/cron.d/zz-ustar2", "/.ustar5", "/.ustar6")

// ===== net_xo_vsa_2026_062_c2_ip.yml (-p azure_monitor)
SecurityEvent
| where DestinationIp =~ "91.211.251.112"

// ===== proxy_xo_empty_object_token_cookie.yml (-p azure_monitor)
// NOT CONVERTED (documented gap): Unable to determine table name. This pipeline has no table for this logsource category. Use KQL Q3 to Q5 instead.

// ===== web_xo_empty_object_token_cookie.yml (-p azure_monitor)
// NOT CONVERTED (documented gap): Unable to determine table name. This pipeline has no table for this logsource category. Use KQL Q3 to Q5 instead.

