index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("185.92.151.150","185.231.68.102")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1430291f2db13c3d94181ada91681408","54e0a0d398314f330dfab6cd55d95f38","e9ed774517e129a170cdb856bd13e7e8","f075c2894ac84df4805e8ccf6491a4f4","05d38c7e957092f7d0ebfc7bf1eb5365","127bf1d43313736c52172f8dc6513f56","9de326bf37270776b78e30d442bda48b","b06319542cab55346776f0358a61b3b3","e3bc4dd84f7a24f24d790cc289e0a10f","84ed6012ec62b0bddcd18058a8ff7ddd","a9fa3eba3f644ba352462b904dfbcc1a","0A0C225F0E5EE941A79F2B7701F1285E4975A2859EB4D025D96D9E366E81ABB9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1430291f2db13c3d94181ada91681408","54e0a0d398314f330dfab6cd55d95f38","e9ed774517e129a170cdb856bd13e7e8","f075c2894ac84df4805e8ccf6491a4f4","05d38c7e957092f7d0ebfc7bf1eb5365","127bf1d43313736c52172f8dc6513f56","9de326bf37270776b78e30d442bda48b","b06319542cab55346776f0358a61b3b3","e3bc4dd84f7a24f24d790cc289e0a10f","84ed6012ec62b0bddcd18058a8ff7ddd","a9fa3eba3f644ba352462b904dfbcc1a","0A0C225F0E5EE941A79F2B7701F1285E4975A2859EB4D025D96D9E366E81ABB9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1430291f2db13c3d94181ada91681408","54e0a0d398314f330dfab6cd55d95f38","e9ed774517e129a170cdb856bd13e7e8","f075c2894ac84df4805e8ccf6491a4f4","05d38c7e957092f7d0ebfc7bf1eb5365","127bf1d43313736c52172f8dc6513f56","9de326bf37270776b78e30d442bda48b","b06319542cab55346776f0358a61b3b3","e3bc4dd84f7a24f24d790cc289e0a10f","84ed6012ec62b0bddcd18058a8ff7ddd","a9fa3eba3f644ba352462b904dfbcc1a","0A0C225F0E5EE941A79F2B7701F1285E4975A2859EB4D025D96D9E366E81ABB9")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1430291f2db13c3d94181ada91681408","54e0a0d398314f330dfab6cd55d95f38","e9ed774517e129a170cdb856bd13e7e8","f075c2894ac84df4805e8ccf6491a4f4","05d38c7e957092f7d0ebfc7bf1eb5365","127bf1d43313736c52172f8dc6513f56","9de326bf37270776b78e30d442bda48b","b06319542cab55346776f0358a61b3b3","e3bc4dd84f7a24f24d790cc289e0a10f","84ed6012ec62b0bddcd18058a8ff7ddd","a9fa3eba3f644ba352462b904dfbcc1a","0A0C225F0E5EE941A79F2B7701F1285E4975A2859EB4D025D96D9E366E81ABB9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1430291f2db13c3d94181ada91681408","54e0a0d398314f330dfab6cd55d95f38","e9ed774517e129a170cdb856bd13e7e8","f075c2894ac84df4805e8ccf6491a4f4","05d38c7e957092f7d0ebfc7bf1eb5365","127bf1d43313736c52172f8dc6513f56","9de326bf37270776b78e30d442bda48b","b06319542cab55346776f0358a61b3b3","e3bc4dd84f7a24f24d790cc289e0a10f","84ed6012ec62b0bddcd18058a8ff7ddd","a9fa3eba3f644ba352462b904dfbcc1a","0A0C225F0E5EE941A79F2B7701F1285E4975A2859EB4D025D96D9E366E81ABB9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1430291f2db13c3d94181ada91681408","54e0a0d398314f330dfab6cd55d95f38","e9ed774517e129a170cdb856bd13e7e8","f075c2894ac84df4805e8ccf6491a4f4","05d38c7e957092f7d0ebfc7bf1eb5365","127bf1d43313736c52172f8dc6513f56","9de326bf37270776b78e30d442bda48b","b06319542cab55346776f0358a61b3b3","e3bc4dd84f7a24f24d790cc289e0a10f","84ed6012ec62b0bddcd18058a8ff7ddd","a9fa3eba3f644ba352462b904dfbcc1a","0A0C225F0E5EE941A79F2B7701F1285E4975A2859EB4D025D96D9E366E81ABB9")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "baroquetees.com" OR destinationhostname CONTAINS "rumahsia.com" OR destinationhostname CONTAINS "max-ghoster1.azureedge.net" OR destinationhostname CONTAINS "atlant20.azureedge.net" OR destinationhostname CONTAINS "skolibri13.azureedge.net" OR destinationhostname CONTAINS "w2doger.xyz")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "baroquetees.com" OR destinationhostname CONTAINS "rumahsia.com" OR destinationhostname CONTAINS "max-ghoster1.azureedge.net" OR destinationhostname CONTAINS "atlant20.azureedge.net" OR destinationhostname CONTAINS "skolibri13.azureedge.net" OR destinationhostname CONTAINS "w2doger.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "baroquetees.com" OR destinationhostname CONTAINS "rumahsia.com" OR destinationhostname CONTAINS "max-ghoster1.azureedge.net" OR destinationhostname CONTAINS "atlant20.azureedge.net" OR destinationhostname CONTAINS "skolibri13.azureedge.net" OR destinationhostname CONTAINS "w2doger.xyz")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://sdoc.xyz/ID-508260156241")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="81.91.177.54" AND destinationport=7234))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="81.91.177.54" AND destinationport=7234))
