index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("4f0ab867a2abdec6957b5a0a0f9cde53","d100fe44b46a8706be28ecaec19de63a","50f192dd5ed9cef64b3c4c03ac0de67d","842ee5e1e7b50b6e4916c177ace9debc","9a2de44916c0f37396eead505508284b","96ea8602c7b268311c6a0b409757d803","3e5b26a5a8e996d5e95339ee3a487a5a","0faf36548b8396851368c532ad4ac348","36c81100c86a491e628105884bdfeab8","90adaadf02f2e1a90bdae790de7d565f","53b31f65bb6ced61c5bafa8e4c98e9e8","74572fba26f5e988b297ec5ea5c8ac1c","0acecad57c4015e14d9b3bb02b433d3e","cafb6b5795c26376289832cffc3aee94","d6b2485e037d3d177de82102f30860d8","1f4add4a2386b8d47aa8a909c2b16d69")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4f0ab867a2abdec6957b5a0a0f9cde53","d100fe44b46a8706be28ecaec19de63a","50f192dd5ed9cef64b3c4c03ac0de67d","842ee5e1e7b50b6e4916c177ace9debc","9a2de44916c0f37396eead505508284b","96ea8602c7b268311c6a0b409757d803","3e5b26a5a8e996d5e95339ee3a487a5a","0faf36548b8396851368c532ad4ac348","36c81100c86a491e628105884bdfeab8","90adaadf02f2e1a90bdae790de7d565f","53b31f65bb6ced61c5bafa8e4c98e9e8","74572fba26f5e988b297ec5ea5c8ac1c","0acecad57c4015e14d9b3bb02b433d3e","cafb6b5795c26376289832cffc3aee94","d6b2485e037d3d177de82102f30860d8","1f4add4a2386b8d47aa8a909c2b16d69")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4f0ab867a2abdec6957b5a0a0f9cde53","d100fe44b46a8706be28ecaec19de63a","50f192dd5ed9cef64b3c4c03ac0de67d","842ee5e1e7b50b6e4916c177ace9debc","9a2de44916c0f37396eead505508284b","96ea8602c7b268311c6a0b409757d803","3e5b26a5a8e996d5e95339ee3a487a5a","0faf36548b8396851368c532ad4ac348","36c81100c86a491e628105884bdfeab8","90adaadf02f2e1a90bdae790de7d565f","53b31f65bb6ced61c5bafa8e4c98e9e8","74572fba26f5e988b297ec5ea5c8ac1c","0acecad57c4015e14d9b3bb02b433d3e","cafb6b5795c26376289832cffc3aee94","d6b2485e037d3d177de82102f30860d8","1f4add4a2386b8d47aa8a909c2b16d69")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("4f0ab867a2abdec6957b5a0a0f9cde53","d100fe44b46a8706be28ecaec19de63a","50f192dd5ed9cef64b3c4c03ac0de67d","842ee5e1e7b50b6e4916c177ace9debc","9a2de44916c0f37396eead505508284b","96ea8602c7b268311c6a0b409757d803","3e5b26a5a8e996d5e95339ee3a487a5a","0faf36548b8396851368c532ad4ac348","36c81100c86a491e628105884bdfeab8","90adaadf02f2e1a90bdae790de7d565f","53b31f65bb6ced61c5bafa8e4c98e9e8","74572fba26f5e988b297ec5ea5c8ac1c","0acecad57c4015e14d9b3bb02b433d3e","cafb6b5795c26376289832cffc3aee94","d6b2485e037d3d177de82102f30860d8","1f4add4a2386b8d47aa8a909c2b16d69")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4f0ab867a2abdec6957b5a0a0f9cde53","d100fe44b46a8706be28ecaec19de63a","50f192dd5ed9cef64b3c4c03ac0de67d","842ee5e1e7b50b6e4916c177ace9debc","9a2de44916c0f37396eead505508284b","96ea8602c7b268311c6a0b409757d803","3e5b26a5a8e996d5e95339ee3a487a5a","0faf36548b8396851368c532ad4ac348","36c81100c86a491e628105884bdfeab8","90adaadf02f2e1a90bdae790de7d565f","53b31f65bb6ced61c5bafa8e4c98e9e8","74572fba26f5e988b297ec5ea5c8ac1c","0acecad57c4015e14d9b3bb02b433d3e","cafb6b5795c26376289832cffc3aee94","d6b2485e037d3d177de82102f30860d8","1f4add4a2386b8d47aa8a909c2b16d69")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4f0ab867a2abdec6957b5a0a0f9cde53","d100fe44b46a8706be28ecaec19de63a","50f192dd5ed9cef64b3c4c03ac0de67d","842ee5e1e7b50b6e4916c177ace9debc","9a2de44916c0f37396eead505508284b","96ea8602c7b268311c6a0b409757d803","3e5b26a5a8e996d5e95339ee3a487a5a","0faf36548b8396851368c532ad4ac348","36c81100c86a491e628105884bdfeab8","90adaadf02f2e1a90bdae790de7d565f","53b31f65bb6ced61c5bafa8e4c98e9e8","74572fba26f5e988b297ec5ea5c8ac1c","0acecad57c4015e14d9b3bb02b433d3e","cafb6b5795c26376289832cffc3aee94","d6b2485e037d3d177de82102f30860d8","1f4add4a2386b8d47aa8a909c2b16d69")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "account-inbox.online" OR destinationhostname CONTAINS "accounts-inbox.ml" OR destinationhostname CONTAINS "accounts-telekom.online" OR destinationhostname CONTAINS "com-account.website" OR destinationhostname CONTAINS "credentials-telekom.online" OR destinationhostname CONTAINS "google-com.online" OR destinationhostname CONTAINS "inbox-admin.site" OR destinationhostname CONTAINS "interia-pl.site" OR destinationhostname CONTAINS "interia-pl.website" OR destinationhostname CONTAINS "login-inbox.online" OR destinationhostname CONTAINS "login-mail.online" OR destinationhostname CONTAINS "login-telekom.online" OR destinationhostname CONTAINS "login-verify.online" OR destinationhostname CONTAINS "logowanie-pl.site" OR destinationhostname CONTAINS "meta-ua.online" OR destinationhostname CONTAINS "net-account.online" OR destinationhostname CONTAINS "net-account.space" OR destinationhostname CONTAINS "net-support.site" OR destinationhostname CONTAINS "net-verification.online" OR destinationhostname CONTAINS "net-verify.site" OR destinationhostname CONTAINS "net-verify.website" OR destinationhostname CONTAINS "net-accounts-mail.ru" OR destinationhostname CONTAINS "no-replay-notification.ga" OR destinationhostname CONTAINS "onet-pl.online" OR destinationhostname CONTAINS "ron-mil-pl.site" OR destinationhostname CONTAINS "ron-mil-pl.space" OR destinationhostname CONTAINS "ru-passport.online" OR destinationhostname CONTAINS "passport-yandex.ru" OR destinationhostname CONTAINS "signin-telekom.online" OR destinationhostname CONTAINS "ua-agreements.online" OR destinationhostname CONTAINS "ua-login.site" OR destinationhostname CONTAINS "ua-passport.online" OR destinationhostname CONTAINS "ukroboronprom-com.site" OR destinationhostname CONTAINS "ukroboronprom.online" OR destinationhostname CONTAINS "verify-ua.online" OR destinationhostname CONTAINS "verify-ua.site" OR destinationhostname CONTAINS "wp-agreements.online" OR destinationhostname CONTAINS "wp-pl-potwierdz-dostep.site" OR destinationhostname CONTAINS "wp-pl.eu")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "account-inbox.online" OR destinationhostname CONTAINS "accounts-inbox.ml" OR destinationhostname CONTAINS "accounts-telekom.online" OR destinationhostname CONTAINS "com-account.website" OR destinationhostname CONTAINS "credentials-telekom.online" OR destinationhostname CONTAINS "google-com.online" OR destinationhostname CONTAINS "inbox-admin.site" OR destinationhostname CONTAINS "interia-pl.site" OR destinationhostname CONTAINS "interia-pl.website" OR destinationhostname CONTAINS "login-inbox.online" OR destinationhostname CONTAINS "login-mail.online" OR destinationhostname CONTAINS "login-telekom.online" OR destinationhostname CONTAINS "login-verify.online" OR destinationhostname CONTAINS "logowanie-pl.site" OR destinationhostname CONTAINS "meta-ua.online" OR destinationhostname CONTAINS "net-account.online" OR destinationhostname CONTAINS "net-account.space" OR destinationhostname CONTAINS "net-support.site" OR destinationhostname CONTAINS "net-verification.online" OR destinationhostname CONTAINS "net-verify.site" OR destinationhostname CONTAINS "net-verify.website" OR destinationhostname CONTAINS "net-accounts-mail.ru" OR destinationhostname CONTAINS "no-replay-notification.ga" OR destinationhostname CONTAINS "onet-pl.online" OR destinationhostname CONTAINS "ron-mil-pl.site" OR destinationhostname CONTAINS "ron-mil-pl.space" OR destinationhostname CONTAINS "ru-passport.online" OR destinationhostname CONTAINS "passport-yandex.ru" OR destinationhostname CONTAINS "signin-telekom.online" OR destinationhostname CONTAINS "ua-agreements.online" OR destinationhostname CONTAINS "ua-login.site" OR destinationhostname CONTAINS "ua-passport.online" OR destinationhostname CONTAINS "ukroboronprom-com.site" OR destinationhostname CONTAINS "ukroboronprom.online" OR destinationhostname CONTAINS "verify-ua.online" OR destinationhostname CONTAINS "verify-ua.site" OR destinationhostname CONTAINS "wp-agreements.online" OR destinationhostname CONTAINS "wp-pl-potwierdz-dostep.site" OR destinationhostname CONTAINS "wp-pl.eu")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "account-inbox.online" OR destinationhostname CONTAINS "accounts-inbox.ml" OR destinationhostname CONTAINS "accounts-telekom.online" OR destinationhostname CONTAINS "com-account.website" OR destinationhostname CONTAINS "credentials-telekom.online" OR destinationhostname CONTAINS "google-com.online" OR destinationhostname CONTAINS "inbox-admin.site" OR destinationhostname CONTAINS "interia-pl.site" OR destinationhostname CONTAINS "interia-pl.website" OR destinationhostname CONTAINS "login-inbox.online" OR destinationhostname CONTAINS "login-mail.online" OR destinationhostname CONTAINS "login-telekom.online" OR destinationhostname CONTAINS "login-verify.online" OR destinationhostname CONTAINS "logowanie-pl.site" OR destinationhostname CONTAINS "meta-ua.online" OR destinationhostname CONTAINS "net-account.online" OR destinationhostname CONTAINS "net-account.space" OR destinationhostname CONTAINS "net-support.site" OR destinationhostname CONTAINS "net-verification.online" OR destinationhostname CONTAINS "net-verify.site" OR destinationhostname CONTAINS "net-verify.website" OR destinationhostname CONTAINS "net-accounts-mail.ru" OR destinationhostname CONTAINS "no-replay-notification.ga" OR destinationhostname CONTAINS "onet-pl.online" OR destinationhostname CONTAINS "ron-mil-pl.site" OR destinationhostname CONTAINS "ron-mil-pl.space" OR destinationhostname CONTAINS "ru-passport.online" OR destinationhostname CONTAINS "passport-yandex.ru" OR destinationhostname CONTAINS "signin-telekom.online" OR destinationhostname CONTAINS "ua-agreements.online" OR destinationhostname CONTAINS "ua-login.site" OR destinationhostname CONTAINS "ua-passport.online" OR destinationhostname CONTAINS "ukroboronprom-com.site" OR destinationhostname CONTAINS "ukroboronprom.online" OR destinationhostname CONTAINS "verify-ua.online" OR destinationhostname CONTAINS "verify-ua.site" OR destinationhostname CONTAINS "wp-agreements.online" OR destinationhostname CONTAINS "wp-pl-potwierdz-dostep.site" OR destinationhostname CONTAINS "wp-pl.eu")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("﻿https://fashionhouse.us17.list-manage.com/track/click?u=49b72c249fd120fb72b31dd09&id=3bd8c79d59&e=2169aaf971","http://88.99.132.118:1985/update/microsoft_corpshd","http://88.99.132.118:1985/update/microsoft_corpsh","http://88.99.132.118:1985/update/microsoft_corpjs","http://88.99.132.118:1985/update/microsoft_corp/23","http://88.99.104.179:1985/win_update/upgrade","http://88.99.104.179:1985/update/microsoft_crpn","http://88.99.104.179:1985/update/microsoft_corp","http://88.99.104.179:1985/update/microsoft_crp","https://mail.secured-auth.cf/track?rid=3DsWVkk7K")
index=activity AND rg_functionality="Email / Email Security" AND emailsenderdomain NOT NULL AND (emailsenderdomain CONTAINS "ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND emailsenderdomain NOT NULL AND (emailsenderdomain CONTAINS "ukr.net")
index=activity AND rg_functionality="Email / Email Security" AND emailrecipientdomain NOT NULL AND (emailrecipientdomain CONTAINS "ukr.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND emailrecipientdomain NOT NULL AND (emailrecipientdomain CONTAINS "ukr.net")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="88.99.132.118" AND destinationport=1985) OR (destinationaddress="88.99.104.179" AND destinationport=1985))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="88.99.132.118" AND destinationport=1985) OR (destinationaddress="88.99.104.179" AND destinationport=1985))
