// sigma convert -t kusto -p microsoft_xdr, generated 10 Nov 2026. NOT run against a live tenant.
// ===== win_file_zoom_executable_drop.yml (-p microsoft_xdr)
DeviceFileEvents
| where InitiatingProcessFolderPath endswith "\\Zoom.exe" and (FolderPath endswith ".exe" or FolderPath endswith ".dll" or FolderPath endswith ".ps1" or FolderPath endswith ".bat" or FolderPath endswith ".cmd" or FolderPath endswith ".vbs" or FolderPath endswith ".js" or FolderPath endswith ".hta" or FolderPath endswith ".lnk") and (not(FolderPath contains "\\Zoom\\bin"))

// ===== win_zoom_elevated_child.yml (-p microsoft_xdr)
DeviceProcessEvents
| where InitiatingProcessFolderPath endswith "\\Zoom.exe" and (ProcessIntegrityLevel in~ ("High", "System")) and (not(FolderPath contains "\\Zoom\\"))

// ===== win_zoom_spawn_shell_lolbin.yml (-p microsoft_xdr)
DeviceProcessEvents
| where InitiatingProcessFolderPath endswith "\\Zoom.exe" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\schtasks.exe" or FolderPath endswith "\\wmic.exe" or FolderPath endswith "\\msiexec.exe" or FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe" or FolderPath endswith "\\whoami.exe")

