index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("131.153.96.114","185.117.88.19","94.140.112.178")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("40d56f10a54bd8031191638e7df74753315e76f198192b6e3965d182136fc2fa","f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4","7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a","9052568af4c2e9935c837c9bdcffc79183862df083b58aae167a480bd3892ad0","1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40","35f2a4d11264e7729eaf7a7e002de0799d0981057187793c0ba93f636126135f","f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231","25765faedcfee59ce3f5eb3540d70f99f124af4942f24f0666c1374b01b24bd9","d5c81423a856e68ad5edaf410c5dfed783a0ea4770dbc8fb4943406c316a4317","da5a03bd74a271e4c5ef75ccdd065afe9bd1af749dbcff36ec7ce58bf7a7db37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("40d56f10a54bd8031191638e7df74753315e76f198192b6e3965d182136fc2fa","f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4","7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a","9052568af4c2e9935c837c9bdcffc79183862df083b58aae167a480bd3892ad0","1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40","35f2a4d11264e7729eaf7a7e002de0799d0981057187793c0ba93f636126135f","f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231","25765faedcfee59ce3f5eb3540d70f99f124af4942f24f0666c1374b01b24bd9","d5c81423a856e68ad5edaf410c5dfed783a0ea4770dbc8fb4943406c316a4317","da5a03bd74a271e4c5ef75ccdd065afe9bd1af749dbcff36ec7ce58bf7a7db37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("40d56f10a54bd8031191638e7df74753315e76f198192b6e3965d182136fc2fa","f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4","7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a","9052568af4c2e9935c837c9bdcffc79183862df083b58aae167a480bd3892ad0","1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40","35f2a4d11264e7729eaf7a7e002de0799d0981057187793c0ba93f636126135f","f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231","25765faedcfee59ce3f5eb3540d70f99f124af4942f24f0666c1374b01b24bd9","d5c81423a856e68ad5edaf410c5dfed783a0ea4770dbc8fb4943406c316a4317","da5a03bd74a271e4c5ef75ccdd065afe9bd1af749dbcff36ec7ce58bf7a7db37")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("40d56f10a54bd8031191638e7df74753315e76f198192b6e3965d182136fc2fa","f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4","7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a","9052568af4c2e9935c837c9bdcffc79183862df083b58aae167a480bd3892ad0","1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40","35f2a4d11264e7729eaf7a7e002de0799d0981057187793c0ba93f636126135f","f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231","25765faedcfee59ce3f5eb3540d70f99f124af4942f24f0666c1374b01b24bd9","d5c81423a856e68ad5edaf410c5dfed783a0ea4770dbc8fb4943406c316a4317","da5a03bd74a271e4c5ef75ccdd065afe9bd1af749dbcff36ec7ce58bf7a7db37")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("40d56f10a54bd8031191638e7df74753315e76f198192b6e3965d182136fc2fa","f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4","7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a","9052568af4c2e9935c837c9bdcffc79183862df083b58aae167a480bd3892ad0","1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40","35f2a4d11264e7729eaf7a7e002de0799d0981057187793c0ba93f636126135f","f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231","25765faedcfee59ce3f5eb3540d70f99f124af4942f24f0666c1374b01b24bd9","d5c81423a856e68ad5edaf410c5dfed783a0ea4770dbc8fb4943406c316a4317","da5a03bd74a271e4c5ef75ccdd065afe9bd1af749dbcff36ec7ce58bf7a7db37")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("40d56f10a54bd8031191638e7df74753315e76f198192b6e3965d182136fc2fa","f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4","7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a","9052568af4c2e9935c837c9bdcffc79183862df083b58aae167a480bd3892ad0","1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40","35f2a4d11264e7729eaf7a7e002de0799d0981057187793c0ba93f636126135f","f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231","25765faedcfee59ce3f5eb3540d70f99f124af4942f24f0666c1374b01b24bd9","d5c81423a856e68ad5edaf410c5dfed783a0ea4770dbc8fb4943406c316a4317","da5a03bd74a271e4c5ef75ccdd065afe9bd1af749dbcff36ec7ce58bf7a7db37")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "wordkeyvpload.net" OR destinationhostname CONTAINS "wordkeyvpload.org" OR destinationhostname CONTAINS "jimbeam.live" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "wordkeyvpload.net" OR destinationhostname CONTAINS "wordkeyvpload.org" OR destinationhostname CONTAINS "jimbeam.live" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "wordkeyvpload.net" OR destinationhostname CONTAINS "wordkeyvpload.org" OR destinationhostname CONTAINS "jimbeam.live" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://wordkeyvpload.net/keys/Missions Budget Lb.xls","https://wordkeyvpload.net/keys/parliament_rew.xls","https://wordkeyvpload.net/keys/Missions Budget.xls","https://wordkeyvpload.net/keys/TR_comparison.xls","https://wordkeyvpload.net/keys/JjnJq3.html","https://wordkeyvpload.net/keys/iz7hfD.html","https://wordkeyvpload.net/keys/Ari2Rc.html","https://wordkeyvpload.net/keys/OD4cNq.html","https://wordkeyvpload.net/keys/0YOL4.cab","https://wordkeyvpload.net/keys/whmel.cab","https://wordkeyvpload.net/keys/UdOpQ.cab","https://wordkeyvpload.net/keys/D9V5E.cab","https://wordkeyvpload.net/keys/update.dat","https://wordkeyvpload.org/index.jsp","https://wordkeyvpload.org/index.php","https://wordkeyvpload.org/news.php","https://wordkeyvpload.org/admin/get.php","https://wordkeyvpload.org/login/process.php")
