// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_xo_vsa_2026_062_ustar_files.yml (--without-pipeline)
TargetFilename in~ ("/etc/cron.d/zz-ustar", "/etc/cron.d/zz-ustar2", "/.ustar5", "/.ustar6")

// ===== net_xo_vsa_2026_062_c2_ip.yml (--without-pipeline)
DestinationIp =~ "91.211.251.112"

// ===== proxy_xo_empty_object_token_cookie.yml (--without-pipeline)
''cs-cookie'' contains "authenticationToken=j:%7B%7D" or ''cs-cookie'' contains "authenticationToken=j:{}"

// ===== web_xo_empty_object_token_cookie.yml (--without-pipeline)
''cs-cookie'' contains "authenticationToken=j:%7B%7D" or ''cs-cookie'' contains "authenticationToken=j:{}"

