index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("ed9aa858ba2c4671ca373496a4dd05d4","71759cca8c700646b4976b19b9abd6fe","3ba4c71c6b087e6d06d668bb22a5b59a","d5e974a3386fc99d2932756ca165a451","f4d46629ca15313b94992f3798718df7","118cfa75e386ed45bec297f8865de671","53648bf8f0121130edb42c626d7c2fc4","1bb267c96ec2925f6ae3716d831671cf","0812ce08a75e5fc774a114436e88cd06","927f0a1090255bc724953e1f5a09a070","145735911e9c8bafa4c9c1d7397199fc","551c5b3595e9fc1081b5e1f10e3c1a59","f3fcb306cb93489f999e00a7ef63536b","0ecfa51cd4bf1a9841a07bdb5bfcd0ab","4d30612a928faf7643b14bd85d8433cc","df1e7a42c92ecb01290d896dca4e5faa","3b1b8702c4d3e2e194c4cc8f09a57d06","ef3a6978c7d454f9f6316f2d267f108d","33c2e887c3d337eeffbbd8745bfdfc8f","bf4a822f04193b953689e277a9e1f4f1","6e710f6f02fdde1e4adf06935a296fd8","38917e8aa02b58b09401383115ab549e","67220baf2a415876bee2d43c11f6e9ad","3bf9b83e00544ac383aaef795e3ded78","159ad2afcab80e83397388e495d215a5","21ec5f03aab696f0a239c6ea5e50c014","b5874eb1119327be51ae03adcbf4d3e0","8b378eabcec13c3c925cc7ca4d191f5f","5b387a9130e9b9782ca4c225c8e641b3","25c8e057864126e6648c34581e7b4f20","62eae43a36cbc4ed935d8df007f5650b","8d74112c97e98fef4c5d77200f34e4f2","b5648f5e115da778615dfd0dc772b647","eef723ff0b5c0b10d391955250f781b3","d1a99087fa3793fbc4d0adb26e87efce","d63bb2c5cd4cfbe8fabf1640b569db6a","fffad123bd6df76f94ffc9b384a067fc","abaeecd83a585ec0c5f1153199938e83","569246a3325effa11cb8ff362428ab2c","3b494133f1a673b2b04df4f4f996a25d","fc3c31bbdbeee99aba5f7a735fac7a7e","d96fcd2159643684f4573238f530d03b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ed9aa858ba2c4671ca373496a4dd05d4","71759cca8c700646b4976b19b9abd6fe","3ba4c71c6b087e6d06d668bb22a5b59a","d5e974a3386fc99d2932756ca165a451","f4d46629ca15313b94992f3798718df7","118cfa75e386ed45bec297f8865de671","53648bf8f0121130edb42c626d7c2fc4","1bb267c96ec2925f6ae3716d831671cf","0812ce08a75e5fc774a114436e88cd06","927f0a1090255bc724953e1f5a09a070","145735911e9c8bafa4c9c1d7397199fc","551c5b3595e9fc1081b5e1f10e3c1a59","f3fcb306cb93489f999e00a7ef63536b","0ecfa51cd4bf1a9841a07bdb5bfcd0ab","4d30612a928faf7643b14bd85d8433cc","df1e7a42c92ecb01290d896dca4e5faa","3b1b8702c4d3e2e194c4cc8f09a57d06","ef3a6978c7d454f9f6316f2d267f108d","33c2e887c3d337eeffbbd8745bfdfc8f","bf4a822f04193b953689e277a9e1f4f1","6e710f6f02fdde1e4adf06935a296fd8","38917e8aa02b58b09401383115ab549e","67220baf2a415876bee2d43c11f6e9ad","3bf9b83e00544ac383aaef795e3ded78","159ad2afcab80e83397388e495d215a5","21ec5f03aab696f0a239c6ea5e50c014","b5874eb1119327be51ae03adcbf4d3e0","8b378eabcec13c3c925cc7ca4d191f5f","5b387a9130e9b9782ca4c225c8e641b3","25c8e057864126e6648c34581e7b4f20","62eae43a36cbc4ed935d8df007f5650b","8d74112c97e98fef4c5d77200f34e4f2","b5648f5e115da778615dfd0dc772b647","eef723ff0b5c0b10d391955250f781b3","d1a99087fa3793fbc4d0adb26e87efce","d63bb2c5cd4cfbe8fabf1640b569db6a","fffad123bd6df76f94ffc9b384a067fc","abaeecd83a585ec0c5f1153199938e83","569246a3325effa11cb8ff362428ab2c","3b494133f1a673b2b04df4f4f996a25d","fc3c31bbdbeee99aba5f7a735fac7a7e","d96fcd2159643684f4573238f530d03b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ed9aa858ba2c4671ca373496a4dd05d4","71759cca8c700646b4976b19b9abd6fe","3ba4c71c6b087e6d06d668bb22a5b59a","d5e974a3386fc99d2932756ca165a451","f4d46629ca15313b94992f3798718df7","118cfa75e386ed45bec297f8865de671","53648bf8f0121130edb42c626d7c2fc4","1bb267c96ec2925f6ae3716d831671cf","0812ce08a75e5fc774a114436e88cd06","927f0a1090255bc724953e1f5a09a070","145735911e9c8bafa4c9c1d7397199fc","551c5b3595e9fc1081b5e1f10e3c1a59","f3fcb306cb93489f999e00a7ef63536b","0ecfa51cd4bf1a9841a07bdb5bfcd0ab","4d30612a928faf7643b14bd85d8433cc","df1e7a42c92ecb01290d896dca4e5faa","3b1b8702c4d3e2e194c4cc8f09a57d06","ef3a6978c7d454f9f6316f2d267f108d","33c2e887c3d337eeffbbd8745bfdfc8f","bf4a822f04193b953689e277a9e1f4f1","6e710f6f02fdde1e4adf06935a296fd8","38917e8aa02b58b09401383115ab549e","67220baf2a415876bee2d43c11f6e9ad","3bf9b83e00544ac383aaef795e3ded78","159ad2afcab80e83397388e495d215a5","21ec5f03aab696f0a239c6ea5e50c014","b5874eb1119327be51ae03adcbf4d3e0","8b378eabcec13c3c925cc7ca4d191f5f","5b387a9130e9b9782ca4c225c8e641b3","25c8e057864126e6648c34581e7b4f20","62eae43a36cbc4ed935d8df007f5650b","8d74112c97e98fef4c5d77200f34e4f2","b5648f5e115da778615dfd0dc772b647","eef723ff0b5c0b10d391955250f781b3","d1a99087fa3793fbc4d0adb26e87efce","d63bb2c5cd4cfbe8fabf1640b569db6a","fffad123bd6df76f94ffc9b384a067fc","abaeecd83a585ec0c5f1153199938e83","569246a3325effa11cb8ff362428ab2c","3b494133f1a673b2b04df4f4f996a25d","fc3c31bbdbeee99aba5f7a735fac7a7e","d96fcd2159643684f4573238f530d03b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("ed9aa858ba2c4671ca373496a4dd05d4","71759cca8c700646b4976b19b9abd6fe","3ba4c71c6b087e6d06d668bb22a5b59a","d5e974a3386fc99d2932756ca165a451","f4d46629ca15313b94992f3798718df7","118cfa75e386ed45bec297f8865de671","53648bf8f0121130edb42c626d7c2fc4","1bb267c96ec2925f6ae3716d831671cf","0812ce08a75e5fc774a114436e88cd06","927f0a1090255bc724953e1f5a09a070","145735911e9c8bafa4c9c1d7397199fc","551c5b3595e9fc1081b5e1f10e3c1a59","f3fcb306cb93489f999e00a7ef63536b","0ecfa51cd4bf1a9841a07bdb5bfcd0ab","4d30612a928faf7643b14bd85d8433cc","df1e7a42c92ecb01290d896dca4e5faa","3b1b8702c4d3e2e194c4cc8f09a57d06","ef3a6978c7d454f9f6316f2d267f108d","33c2e887c3d337eeffbbd8745bfdfc8f","bf4a822f04193b953689e277a9e1f4f1","6e710f6f02fdde1e4adf06935a296fd8","38917e8aa02b58b09401383115ab549e","67220baf2a415876bee2d43c11f6e9ad","3bf9b83e00544ac383aaef795e3ded78","159ad2afcab80e83397388e495d215a5","21ec5f03aab696f0a239c6ea5e50c014","b5874eb1119327be51ae03adcbf4d3e0","8b378eabcec13c3c925cc7ca4d191f5f","5b387a9130e9b9782ca4c225c8e641b3","25c8e057864126e6648c34581e7b4f20","62eae43a36cbc4ed935d8df007f5650b","8d74112c97e98fef4c5d77200f34e4f2","b5648f5e115da778615dfd0dc772b647","eef723ff0b5c0b10d391955250f781b3","d1a99087fa3793fbc4d0adb26e87efce","d63bb2c5cd4cfbe8fabf1640b569db6a","fffad123bd6df76f94ffc9b384a067fc","abaeecd83a585ec0c5f1153199938e83","569246a3325effa11cb8ff362428ab2c","3b494133f1a673b2b04df4f4f996a25d","fc3c31bbdbeee99aba5f7a735fac7a7e","d96fcd2159643684f4573238f530d03b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ed9aa858ba2c4671ca373496a4dd05d4","71759cca8c700646b4976b19b9abd6fe","3ba4c71c6b087e6d06d668bb22a5b59a","d5e974a3386fc99d2932756ca165a451","f4d46629ca15313b94992f3798718df7","118cfa75e386ed45bec297f8865de671","53648bf8f0121130edb42c626d7c2fc4","1bb267c96ec2925f6ae3716d831671cf","0812ce08a75e5fc774a114436e88cd06","927f0a1090255bc724953e1f5a09a070","145735911e9c8bafa4c9c1d7397199fc","551c5b3595e9fc1081b5e1f10e3c1a59","f3fcb306cb93489f999e00a7ef63536b","0ecfa51cd4bf1a9841a07bdb5bfcd0ab","4d30612a928faf7643b14bd85d8433cc","df1e7a42c92ecb01290d896dca4e5faa","3b1b8702c4d3e2e194c4cc8f09a57d06","ef3a6978c7d454f9f6316f2d267f108d","33c2e887c3d337eeffbbd8745bfdfc8f","bf4a822f04193b953689e277a9e1f4f1","6e710f6f02fdde1e4adf06935a296fd8","38917e8aa02b58b09401383115ab549e","67220baf2a415876bee2d43c11f6e9ad","3bf9b83e00544ac383aaef795e3ded78","159ad2afcab80e83397388e495d215a5","21ec5f03aab696f0a239c6ea5e50c014","b5874eb1119327be51ae03adcbf4d3e0","8b378eabcec13c3c925cc7ca4d191f5f","5b387a9130e9b9782ca4c225c8e641b3","25c8e057864126e6648c34581e7b4f20","62eae43a36cbc4ed935d8df007f5650b","8d74112c97e98fef4c5d77200f34e4f2","b5648f5e115da778615dfd0dc772b647","eef723ff0b5c0b10d391955250f781b3","d1a99087fa3793fbc4d0adb26e87efce","d63bb2c5cd4cfbe8fabf1640b569db6a","fffad123bd6df76f94ffc9b384a067fc","abaeecd83a585ec0c5f1153199938e83","569246a3325effa11cb8ff362428ab2c","3b494133f1a673b2b04df4f4f996a25d","fc3c31bbdbeee99aba5f7a735fac7a7e","d96fcd2159643684f4573238f530d03b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ed9aa858ba2c4671ca373496a4dd05d4","71759cca8c700646b4976b19b9abd6fe","3ba4c71c6b087e6d06d668bb22a5b59a","d5e974a3386fc99d2932756ca165a451","f4d46629ca15313b94992f3798718df7","118cfa75e386ed45bec297f8865de671","53648bf8f0121130edb42c626d7c2fc4","1bb267c96ec2925f6ae3716d831671cf","0812ce08a75e5fc774a114436e88cd06","927f0a1090255bc724953e1f5a09a070","145735911e9c8bafa4c9c1d7397199fc","551c5b3595e9fc1081b5e1f10e3c1a59","f3fcb306cb93489f999e00a7ef63536b","0ecfa51cd4bf1a9841a07bdb5bfcd0ab","4d30612a928faf7643b14bd85d8433cc","df1e7a42c92ecb01290d896dca4e5faa","3b1b8702c4d3e2e194c4cc8f09a57d06","ef3a6978c7d454f9f6316f2d267f108d","33c2e887c3d337eeffbbd8745bfdfc8f","bf4a822f04193b953689e277a9e1f4f1","6e710f6f02fdde1e4adf06935a296fd8","38917e8aa02b58b09401383115ab549e","67220baf2a415876bee2d43c11f6e9ad","3bf9b83e00544ac383aaef795e3ded78","159ad2afcab80e83397388e495d215a5","21ec5f03aab696f0a239c6ea5e50c014","b5874eb1119327be51ae03adcbf4d3e0","8b378eabcec13c3c925cc7ca4d191f5f","5b387a9130e9b9782ca4c225c8e641b3","25c8e057864126e6648c34581e7b4f20","62eae43a36cbc4ed935d8df007f5650b","8d74112c97e98fef4c5d77200f34e4f2","b5648f5e115da778615dfd0dc772b647","eef723ff0b5c0b10d391955250f781b3","d1a99087fa3793fbc4d0adb26e87efce","d63bb2c5cd4cfbe8fabf1640b569db6a","fffad123bd6df76f94ffc9b384a067fc","abaeecd83a585ec0c5f1153199938e83","569246a3325effa11cb8ff362428ab2c","3b494133f1a673b2b04df4f4f996a25d","fc3c31bbdbeee99aba5f7a735fac7a7e","d96fcd2159643684f4573238f530d03b")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://ddjm.co.kr/bbs/icon/skin/skin.php","http://hivekorea.com/jdboard/member/list.php","http://mail.namusoft.kr/jsp/user/eam/board.jsp","http://mail.sisnet.co.kr/jsp/user/sms/sms_recv.jsp","http://snum.or.kr/skin_img/skin.php","http://www.allamwith.com/home/mobile/list.php","http://www.conkorea.com/cshop/banner/list.php","http://www.ddjm.co.kr/bbs/icon/skin/skin.php","http://www.jinjinpig.co.kr/Anyboard/skin/board.php")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="198.55.119.112" AND destinationport=443) OR (destinationaddress="45.58.112.77" AND destinationport=443) OR (destinationaddress="23.229.111.197" AND destinationport=8443) OR (destinationaddress="23.229.111.197" AND destinationport=443) OR (destinationaddress="185.208.158.208" AND destinationport=443))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="198.55.119.112" AND destinationport=443) OR (destinationaddress="45.58.112.77" AND destinationport=443) OR (destinationaddress="23.229.111.197" AND destinationport=8443) OR (destinationaddress="23.229.111.197" AND destinationport=443) OR (destinationaddress="185.208.158.208" AND destinationport=443))
