// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant.
// ===== win_file_zoom_executable_drop.yml (--without-pipeline)
Image endswith "\\Zoom.exe" and (TargetFilename endswith ".exe" or TargetFilename endswith ".dll" or TargetFilename endswith ".ps1" or TargetFilename endswith ".bat" or TargetFilename endswith ".cmd" or TargetFilename endswith ".vbs" or TargetFilename endswith ".js" or TargetFilename endswith ".hta" or TargetFilename endswith ".lnk") and (not(TargetFilename contains "\\Zoom\\bin"))

// ===== win_zoom_elevated_child.yml (--without-pipeline)
ParentImage endswith "\\Zoom.exe" and (IntegrityLevel in~ ("High", "System")) and (not(Image contains "\\Zoom\\"))

// ===== win_zoom_spawn_shell_lolbin.yml (--without-pipeline)
ParentImage endswith "\\Zoom.exe" and (Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe" or Image endswith "\\wscript.exe" or Image endswith "\\cscript.exe" or Image endswith "\\mshta.exe" or Image endswith "\\rundll32.exe" or Image endswith "\\regsvr32.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\schtasks.exe" or Image endswith "\\wmic.exe" or Image endswith "\\msiexec.exe" or Image endswith "\\net.exe" or Image endswith "\\net1.exe" or Image endswith "\\whoami.exe")

