index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("a0e2223868b6133c5712ba5ed20c3e8a","17614fdee3b89272e99758983b99111cbb1b312c","c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a0e2223868b6133c5712ba5ed20c3e8a","17614fdee3b89272e99758983b99111cbb1b312c","c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a0e2223868b6133c5712ba5ed20c3e8a","17614fdee3b89272e99758983b99111cbb1b312c","c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a0e2223868b6133c5712ba5ed20c3e8a","17614fdee3b89272e99758983b99111cbb1b312c","c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a0e2223868b6133c5712ba5ed20c3e8a","17614fdee3b89272e99758983b99111cbb1b312c","c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a0e2223868b6133c5712ba5ed20c3e8a","17614fdee3b89272e99758983b99111cbb1b312c","c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "noc-service-streamer.com" OR destinationhostname CONTAINS "fbcdnads.live" OR destinationhostname CONTAINS "hilocake.info" OR destinationhostname CONTAINS "backxercise.com" OR destinationhostname CONTAINS "winmslaf.xyz" OR destinationhostname CONTAINS "service-deamon.com" OR destinationhostname CONTAINS "online-affiliate-mon.com" OR destinationhostname CONTAINS "codeingasmylife.com" OR destinationhostname CONTAINS "kenoratravels.com" OR destinationhostname CONTAINS "weathercheck.digital" OR destinationhostname CONTAINS "colorpallatess.com" OR destinationhostname CONTAINS "library-update.com" OR destinationhostname CONTAINS "online-source-validate.com" OR destinationhostname CONTAINS "grayhornet.com" OR destinationhostname CONTAINS "johnshopkin.net" OR destinationhostname CONTAINS "eulenformacion.com" OR destinationhostname CONTAINS "pochtarossiy.info")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "noc-service-streamer.com" OR destinationhostname CONTAINS "fbcdnads.live" OR destinationhostname CONTAINS "hilocake.info" OR destinationhostname CONTAINS "backxercise.com" OR destinationhostname CONTAINS "winmslaf.xyz" OR destinationhostname CONTAINS "service-deamon.com" OR destinationhostname CONTAINS "online-affiliate-mon.com" OR destinationhostname CONTAINS "codeingasmylife.com" OR destinationhostname CONTAINS "kenoratravels.com" OR destinationhostname CONTAINS "weathercheck.digital" OR destinationhostname CONTAINS "colorpallatess.com" OR destinationhostname CONTAINS "library-update.com" OR destinationhostname CONTAINS "online-source-validate.com" OR destinationhostname CONTAINS "grayhornet.com" OR destinationhostname CONTAINS "johnshopkin.net" OR destinationhostname CONTAINS "eulenformacion.com" OR destinationhostname CONTAINS "pochtarossiy.info")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "noc-service-streamer.com" OR destinationhostname CONTAINS "fbcdnads.live" OR destinationhostname CONTAINS "hilocake.info" OR destinationhostname CONTAINS "backxercise.com" OR destinationhostname CONTAINS "winmslaf.xyz" OR destinationhostname CONTAINS "service-deamon.com" OR destinationhostname CONTAINS "online-affiliate-mon.com" OR destinationhostname CONTAINS "codeingasmylife.com" OR destinationhostname CONTAINS "kenoratravels.com" OR destinationhostname CONTAINS "weathercheck.digital" OR destinationhostname CONTAINS "colorpallatess.com" OR destinationhostname CONTAINS "library-update.com" OR destinationhostname CONTAINS "online-source-validate.com" OR destinationhostname CONTAINS "grayhornet.com" OR destinationhostname CONTAINS "johnshopkin.net" OR destinationhostname CONTAINS "eulenformacion.com" OR destinationhostname CONTAINS "pochtarossiy.info")
