// sigma convert -t kusto -p sentinel_asim, generated 10 Nov 2026. NOT run against a live tenant.
// ===== lnx_xo_vsa_2026_062_ustar_files.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName in~ ("/etc/cron.d/zz-ustar", "/etc/cron.d/zz-ustar2", "/.ustar5", "/.ustar6")

// ===== net_xo_vsa_2026_062_c2_ip.yml (-p sentinel_asim)
imNetworkSession
| where DstIpAddr =~ "91.211.251.112"

// ===== proxy_xo_empty_object_token_cookie.yml (-p sentinel_asim)
// NOT CONVERTED (documented gap): Invalid SigmaDetectionItem field name encountered: cs-cookie. This pipeline has no mapping for the cookie field. Use KQL Q3 to Q5 instead.

// ===== web_xo_empty_object_token_cookie.yml (-p sentinel_asim)
// NOT CONVERTED (documented gap): Invalid SigmaDetectionItem field name encountered: cs-cookie. This pipeline has no mapping for the cookie field. Use KQL Q3 to Q5 instead.

