// sigma convert -t kusto -p sentinel_asim, generated 10 Nov 2026. NOT run against a live tenant.
// ===== win_file_zoom_executable_drop.yml (-p sentinel_asim)
imFileEvent
| where TargetFilePath endswith "\\Zoom.exe" and (TargetFileName endswith ".exe" or TargetFileName endswith ".dll" or TargetFileName endswith ".ps1" or TargetFileName endswith ".bat" or TargetFileName endswith ".cmd" or TargetFileName endswith ".vbs" or TargetFileName endswith ".js" or TargetFileName endswith ".hta" or TargetFileName endswith ".lnk") and (not(TargetFileName contains "\\Zoom\\bin"))

// ===== win_zoom_elevated_child.yml (-p sentinel_asim)
imProcessCreate
| where (ParentProcessName endswith "\\Zoom.exe" or ActingProcessName endswith "\\Zoom.exe") and (TargetProcessIntegrityLevel in~ ("High", "System")) and (not(TargetProcessName contains "\\Zoom\\"))

// ===== win_zoom_spawn_shell_lolbin.yml (-p sentinel_asim)
imProcessCreate
| where (ParentProcessName endswith "\\Zoom.exe" or ActingProcessName endswith "\\Zoom.exe") and (TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\bitsadmin.exe" or TargetProcessName endswith "\\schtasks.exe" or TargetProcessName endswith "\\wmic.exe" or TargetProcessName endswith "\\msiexec.exe" or TargetProcessName endswith "\\net.exe" or TargetProcessName endswith "\\net1.exe" or TargetProcessName endswith "\\whoami.exe")

