// sigma convert -t kusto -p microsoft_xdr, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_xo_vsa_2026_062_ustar_files.yml (-p microsoft_xdr)
DeviceFileEvents
| where FolderPath in~ ("/etc/cron.d/zz-ustar", "/etc/cron.d/zz-ustar2", "/.ustar5", "/.ustar6")

// ===== net_xo_vsa_2026_062_c2_ip.yml (-p microsoft_xdr)
DeviceNetworkEvents
| where RemoteIP =~ "91.211.251.112"

// ===== proxy_xo_empty_object_token_cookie.yml (-p microsoft_xdr)
// NOT CONVERTED (documented gap): Unable to determine table name. This pipeline has no table for this logsource category. Use KQL Q3 to Q5 instead.

// ===== web_xo_empty_object_token_cookie.yml (-p microsoft_xdr)
// NOT CONVERTED (documented gap): Unable to determine table name. This pipeline has no table for this logsource category. Use KQL Q3 to Q5 instead.

