index=activity AND rg_functionality="Next Generation Firewall" AND (requesturl CONTAINS “${script” OR requesturl CONTAINS “${url” OR requesturl CONTAINS “${dns” OR requesturl CONTAINS “%24%7Bscript” OR requesturl CONTAINS “%24%7Burl” OR requesturl CONTAINS “%24%7Bdns”) AND requesturl CONTAINS “java.lang.Runtime”
index=activity AND rg_functionality="Web Application Firewall" AND (requesturl CONTAINS “${script” OR requesturl CONTAINS “${url” OR requesturl CONTAINS “${dns” OR requesturl CONTAINS “%24%7Bscript” OR requesturl CONTAINS “%24%7Burl” OR requesturl CONTAINS “%24%7Bdns”) AND requesturl CONTAINS “java.lang.Runtime”
index=activity AND rg_functionality="Web Proxy" AND (requesturl CONTAINS “${script” OR requesturl CONTAINS “${url” OR requesturl CONTAINS “${dns” OR requesturl CONTAINS “%24%7Bscript” OR requesturl CONTAINS “%24%7Burl” OR requesturl CONTAINS “%24%7Bdns”) AND requesturl CONTAINS “java.lang.Runtime”
index=activity AND rg_functionality="Web Server" AND requestcontext CONTAINS “java.lang.Runtime” AND ((requestcontext CONTAINS “${script” OR requestcontext CONTAINS “${url” OR requestcontext CONTAINS “${dns” OR requestcontext CONTAINS “%24%7Bscript” OR requestcontext CONTAINS “%24%7Burl” OR requestcontext CONTAINS “%24%7Bdns”) OR (requestclientapplication CONTAINS “${script” OR requestclientapplication CONTAINS “${url” OR requestclientapplication CONTAINS “${dns” OR requestclientapplication CONTAINS “%24%7Bscript” OR requestclientapplication CONTAINS “%24%7Burl” OR requestclientapplication CONTAINS “%24%7Bdns”))
index=activity AND rg_functionality="process_events" AND (destinationprocessname ENDS WITH “less” OR destinationprocessname ENDS WITH “vi” OR destinationprocessname ENDS WITH “vim” OR destinationprocessname ENDS WITH “tail” OR destinationprocessname ENDS WITH “nl” OR destinationprocessname ENDS WITH “head” OR destinationprocessname ENDS WITH “nano” OR destinationprocessname ENDS WITH “cat”) AND resourcecustomfield1 CONTAINS “/etc/passwd”
index=activity AND rg_functionality="process_events" AND (destinationprocessname ENDS WITH “less” OR destinationprocessname ENDS WITH “vi” OR destinationprocessname ENDS WITH “vim” OR destinationprocessname ENDS WITH “tail” OR destinationprocessname ENDS WITH “nl” OR destinationprocessname ENDS WITH “head” OR destinationprocessname ENDS WITH “nano” OR destinationprocessname ENDS WITH “cat”) AND resourcecustomfield1 CONTAINS “/etc/shadow”
index=activity AND rg_functionality="Next Generation Firewall" AND (requesturl CONTAINS “/etc/passwd” OR requesturl CONTAINS “%2Fetc%2Fpasswd”) AND (destinationaddress = “10.0.0.0/8” OR destinationaddress = “172.16.0.0/12” OR destinationaddress = “192.168.0.0/16”)
index=activity AND rg_functionality="Web Application Firewall" AND (requesturl CONTAINS “/etc/passwd” OR requesturl CONTAINS “%2Fetc%2Fpasswd”) AND (destinationaddress = “10.0.0.0/8” OR destinationaddress = “172.16.0.0/12” OR destinationaddress = “192.168.0.0/16”)
index=activity AND rg_functionality="Web Proxy" AND (requesturl CONTAINS “/etc/passwd” OR requesturl CONTAINS “%2Fetc%2Fpasswd”) AND (destinationaddress = “10.0.0.0/8” OR destinationaddress = “172.16.0.0/12” OR destinationaddress = “192.168.0.0/16”)
index=activity AND rg_functionality="Web Server" AND (requestcontext CONTAINS “/etc/passwd” OR requestcontext CONTAINS “%2Fetc%2Fpasswd”) AND (deviceaddress = “10.0.0.0/8” OR deviceaddress = “172.16.0.0/12” OR deviceaddress = “192.168.0.0/16”)
index=activity AND rg_functionality="Network Traffic Analytics" AND uri NOT NULL AND (uri CONTAINS “${script” OR uri CONTAINS “${url” OR uri CONTAINS “${dns” OR uri CONTAINS “%24%7Bscript” OR uri CONTAINS “%24%7Burl” OR uri CONTAINS “%24%7Bdns”) AND uri CONTAINS “java.lang.Runtime”
index=activity AND rg_functionality="Network Traffic Analytics" AND uri NOT NULL AND (uri CONTAINS “/etc/passwd” OR uri CONTAINS “%2Fetc%2Fpasswd”)
