// sigma convert -t kusto -p azure_monitor, generated 10 Nov 2026. NOT run against a live tenant.
// ===== win_file_zoom_executable_drop.yml (-p azure_monitor)
SecurityEvent
| where NewProcessName endswith "\\Zoom.exe" and (ObjectName endswith ".exe" or ObjectName endswith ".dll" or ObjectName endswith ".ps1" or ObjectName endswith ".bat" or ObjectName endswith ".cmd" or ObjectName endswith ".vbs" or ObjectName endswith ".js" or ObjectName endswith ".hta" or ObjectName endswith ".lnk") and (not(ObjectName contains "\\Zoom\\bin"))

// ===== win_zoom_elevated_child.yml (-p azure_monitor)
// NOT CONVERTED: Invalid SigmaDetectionItem field name encountered: IntegrityLevel. This pipeline maps Windows rules to SecurityEvent and has no mapping for it.

// ===== win_zoom_spawn_shell_lolbin.yml (-p azure_monitor)
SecurityEvent
| where ParentProcessName endswith "\\Zoom.exe" and (NewProcessName endswith "\\cmd.exe" or NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe" or NewProcessName endswith "\\wscript.exe" or NewProcessName endswith "\\cscript.exe" or NewProcessName endswith "\\mshta.exe" or NewProcessName endswith "\\rundll32.exe" or NewProcessName endswith "\\regsvr32.exe" or NewProcessName endswith "\\certutil.exe" or NewProcessName endswith "\\bitsadmin.exe" or NewProcessName endswith "\\schtasks.exe" or NewProcessName endswith "\\wmic.exe" or NewProcessName endswith "\\msiexec.exe" or NewProcessName endswith "\\net.exe" or NewProcessName endswith "\\net1.exe" or NewProcessName endswith "\\whoami.exe")

