index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","4216f63870e2cdfe499d09fce9caa301f9546f60a69c4032cb5fb6d5ceb9af32","829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1","f14b1a91ed1ecd365088ba6de5846788f86689c6c2f2182855d5e0954d62af3b","660e60cc1fd3e155017848a1f6befc4a335825a6ae04f3416b9b148ff156d143","11b5944715da95e4a57ea54968439d955114088222fd2032d4e0282d12a58abb","9d18defe7390c59a1473f79a2407d072a3f365de9834b8d8be25f7e35a76d818","c677a79b853d3858f8c8b86ccd8c76ebbd1508cc9550f1da2d30be491625b744","5098ec21c88e14d9039d232106560b3c87487b51b40d6fef28254c37e4865182")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","4216f63870e2cdfe499d09fce9caa301f9546f60a69c4032cb5fb6d5ceb9af32","829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1","f14b1a91ed1ecd365088ba6de5846788f86689c6c2f2182855d5e0954d62af3b","660e60cc1fd3e155017848a1f6befc4a335825a6ae04f3416b9b148ff156d143","11b5944715da95e4a57ea54968439d955114088222fd2032d4e0282d12a58abb","9d18defe7390c59a1473f79a2407d072a3f365de9834b8d8be25f7e35a76d818","c677a79b853d3858f8c8b86ccd8c76ebbd1508cc9550f1da2d30be491625b744","5098ec21c88e14d9039d232106560b3c87487b51b40d6fef28254c37e4865182")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","4216f63870e2cdfe499d09fce9caa301f9546f60a69c4032cb5fb6d5ceb9af32","829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1","f14b1a91ed1ecd365088ba6de5846788f86689c6c2f2182855d5e0954d62af3b","660e60cc1fd3e155017848a1f6befc4a335825a6ae04f3416b9b148ff156d143","11b5944715da95e4a57ea54968439d955114088222fd2032d4e0282d12a58abb","9d18defe7390c59a1473f79a2407d072a3f365de9834b8d8be25f7e35a76d818","c677a79b853d3858f8c8b86ccd8c76ebbd1508cc9550f1da2d30be491625b744","5098ec21c88e14d9039d232106560b3c87487b51b40d6fef28254c37e4865182")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","4216f63870e2cdfe499d09fce9caa301f9546f60a69c4032cb5fb6d5ceb9af32","829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1","f14b1a91ed1ecd365088ba6de5846788f86689c6c2f2182855d5e0954d62af3b","660e60cc1fd3e155017848a1f6befc4a335825a6ae04f3416b9b148ff156d143","11b5944715da95e4a57ea54968439d955114088222fd2032d4e0282d12a58abb","9d18defe7390c59a1473f79a2407d072a3f365de9834b8d8be25f7e35a76d818","c677a79b853d3858f8c8b86ccd8c76ebbd1508cc9550f1da2d30be491625b744","5098ec21c88e14d9039d232106560b3c87487b51b40d6fef28254c37e4865182")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","4216f63870e2cdfe499d09fce9caa301f9546f60a69c4032cb5fb6d5ceb9af32","829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1","f14b1a91ed1ecd365088ba6de5846788f86689c6c2f2182855d5e0954d62af3b","660e60cc1fd3e155017848a1f6befc4a335825a6ae04f3416b9b148ff156d143","11b5944715da95e4a57ea54968439d955114088222fd2032d4e0282d12a58abb","9d18defe7390c59a1473f79a2407d072a3f365de9834b8d8be25f7e35a76d818","c677a79b853d3858f8c8b86ccd8c76ebbd1508cc9550f1da2d30be491625b744","5098ec21c88e14d9039d232106560b3c87487b51b40d6fef28254c37e4865182")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","4216f63870e2cdfe499d09fce9caa301f9546f60a69c4032cb5fb6d5ceb9af32","829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1","f14b1a91ed1ecd365088ba6de5846788f86689c6c2f2182855d5e0954d62af3b","660e60cc1fd3e155017848a1f6befc4a335825a6ae04f3416b9b148ff156d143","11b5944715da95e4a57ea54968439d955114088222fd2032d4e0282d12a58abb","9d18defe7390c59a1473f79a2407d072a3f365de9834b8d8be25f7e35a76d818","c677a79b853d3858f8c8b86ccd8c76ebbd1508cc9550f1da2d30be491625b744","5098ec21c88e14d9039d232106560b3c87487b51b40d6fef28254c37e4865182")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "markettrendingcenter.com" OR destinationhostname CONTAINS "lm-career.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "markettrendingcenter.com" OR destinationhostname CONTAINS "lm-career.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "markettrendingcenter.com" OR destinationhostname CONTAINS "lm-career.com")
