Detect External Defacement in Sumo Logic CSE

(_sourceCategory=*windows*sysmon* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*)
| parse regex "<EventID>(?<EventCode>\d+)<\/EventID>" nodrop
| parse regex "<Data Name='Image'>(?<Image>[^<]+)<\/Data>" nodrop
| parse regex "<Data Name='CommandLine'>(?<CommandLine>[^<]+)<\/Data>" nodrop
| parse regex "<Data Name='ParentImage'>(?<ParentImage>[^<]+)<\/Data>" nodrop
| parse regex "<Data Name='ParentCommandLine'>(?<ParentCommandLine>[^<]+)<\/Data>" nodrop
| parse regex "<Data Name='TargetFilename'>(?<TargetFilename>[^<]+)<\/Data>" nodrop
| parse regex "<Data Name='User'>(?<User>[^<]+)<\/Data>" nodrop
| parse regex "<Data Name='Computer'>(?<Computer>[^<]+)<\/Data>" nodrop
| where EventCode in ("1", "11")
| where (
    EventCode = "1"
    AND (
      ParentImage matches "*\\w3wp.exe" OR ParentImage matches "*\\httpd.exe" OR
      ParentImage matches "*\\nginx.exe" OR ParentImage matches "*\\php-cgi.exe" OR
      ParentImage matches "*\\php.exe" OR ParentImage matches "*\\apache*.exe" OR
      ParentImage matches "*\\tomcat*.exe" OR ParentImage matches "*\\java.exe"
    )
    AND (
      Image matches "*\\cmd.exe" OR Image matches "*\\powershell.exe" OR
      Image matches "*\\pwsh.exe" OR Image matches "*\\wscript.exe" OR
      Image matches "*\\cscript.exe" OR Image matches "*\\mshta.exe" OR
      Image matches "*\\bash.exe" OR Image matches "*\\sh.exe" OR
      Image matches "*\\python.exe" OR Image matches "*\\perl.exe"
    )
  )
  OR (
    EventCode = "11"
    AND (
      TargetFilename matches "*\\wwwroot\\*" OR TargetFilename matches "*\\inetpub\\*" OR
      TargetFilename matches "*\\htdocs\\*" OR TargetFilename matches "*\\public_html\\*" OR
      TargetFilename matches "*\\webroot\\*"
    )
    AND (
      TargetFilename matches "*.html" OR TargetFilename matches "*.htm" OR
      TargetFilename matches "*.asp" OR TargetFilename matches "*.aspx" OR
      TargetFilename matches "*.php" OR TargetFilename matches "*.js" OR
      TargetFilename matches "*.css" OR TargetFilename matches "*.jsp" OR
      TargetFilename matches "*\\index.*" OR TargetFilename matches "*\\default.*"
    )
    AND NOT (
      Image matches "*\\svchost.exe" OR Image matches "*\\TrustedInstaller.exe" OR
      Image matches "*\\WaAppAgent.exe" OR Image matches "*\\msiexec.exe" OR
      Image matches "*\\WUDFHost.exe" OR Image matches "*\\MicrosoftEdgeUpdate.exe"
    )
  )
| eval DetectionType = if(EventCode = "1", "WebServerSpawnedShell", "WebFileModified")
| eval Severity = if(EventCode = "1", "Critical",
    if(
      Image matches "*\\cmd.exe" OR Image matches "*\\powershell.exe" OR
      Image matches "*\\pwsh.exe" OR Image matches "*\\wscript.exe" OR
      Image matches "*\\cscript.exe",
      "High", "Medium"
    )
  )
| fields _messageTime, Computer, User, TargetFilename, Image, CommandLine, ParentImage, ParentCommandLine, DetectionType, Severity
| sort by _messageTime desc