index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("6f0b92488eae3ccefc0db7a6b0d652ee","45adc4224d2ae9fd75b19417ca6913515c5222ee","457936c28938616495836c472b3389a0870574bee6a5dc026d5bd14979c6202c","58682ca2a49ed4bfb8d5aaf76cf0fade","b00d58e9ffd784db86e77a6a31c76e1bd58ba79b","ab2f84103e95806b25c6d163d6210a21fb3283cd29dddee917d33e654d733425","7b1cf5fc0bfb1021fe0e14e518c32026","380cd990a9e5aec85233ef1d2635dc04d5a96e6b","d4fc76bf8baae39feec23990857c52199e80265a34faeece0d830eb77645c944","a4331ff805b0a8f2a2892777c224b65e","2c5521077dd1a6f5f3558351370880aee9ab7c71","329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483","fa8117afd2dbd20513522f2f8e991262","f7b876edb8fc0c83fd8b665d3c5a1050d4396302","78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff","d1c9c12e08c8e2111da989e2318b1c42","d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d","e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6f0b92488eae3ccefc0db7a6b0d652ee","45adc4224d2ae9fd75b19417ca6913515c5222ee","457936c28938616495836c472b3389a0870574bee6a5dc026d5bd14979c6202c","58682ca2a49ed4bfb8d5aaf76cf0fade","b00d58e9ffd784db86e77a6a31c76e1bd58ba79b","ab2f84103e95806b25c6d163d6210a21fb3283cd29dddee917d33e654d733425","7b1cf5fc0bfb1021fe0e14e518c32026","380cd990a9e5aec85233ef1d2635dc04d5a96e6b","d4fc76bf8baae39feec23990857c52199e80265a34faeece0d830eb77645c944","a4331ff805b0a8f2a2892777c224b65e","2c5521077dd1a6f5f3558351370880aee9ab7c71","329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483","fa8117afd2dbd20513522f2f8e991262","f7b876edb8fc0c83fd8b665d3c5a1050d4396302","78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff","d1c9c12e08c8e2111da989e2318b1c42","d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d","e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6f0b92488eae3ccefc0db7a6b0d652ee","45adc4224d2ae9fd75b19417ca6913515c5222ee","457936c28938616495836c472b3389a0870574bee6a5dc026d5bd14979c6202c","58682ca2a49ed4bfb8d5aaf76cf0fade","b00d58e9ffd784db86e77a6a31c76e1bd58ba79b","ab2f84103e95806b25c6d163d6210a21fb3283cd29dddee917d33e654d733425","7b1cf5fc0bfb1021fe0e14e518c32026","380cd990a9e5aec85233ef1d2635dc04d5a96e6b","d4fc76bf8baae39feec23990857c52199e80265a34faeece0d830eb77645c944","a4331ff805b0a8f2a2892777c224b65e","2c5521077dd1a6f5f3558351370880aee9ab7c71","329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483","fa8117afd2dbd20513522f2f8e991262","f7b876edb8fc0c83fd8b665d3c5a1050d4396302","78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff","d1c9c12e08c8e2111da989e2318b1c42","d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d","e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("6f0b92488eae3ccefc0db7a6b0d652ee","45adc4224d2ae9fd75b19417ca6913515c5222ee","457936c28938616495836c472b3389a0870574bee6a5dc026d5bd14979c6202c","58682ca2a49ed4bfb8d5aaf76cf0fade","b00d58e9ffd784db86e77a6a31c76e1bd58ba79b","ab2f84103e95806b25c6d163d6210a21fb3283cd29dddee917d33e654d733425","7b1cf5fc0bfb1021fe0e14e518c32026","380cd990a9e5aec85233ef1d2635dc04d5a96e6b","d4fc76bf8baae39feec23990857c52199e80265a34faeece0d830eb77645c944","a4331ff805b0a8f2a2892777c224b65e","2c5521077dd1a6f5f3558351370880aee9ab7c71","329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483","fa8117afd2dbd20513522f2f8e991262","f7b876edb8fc0c83fd8b665d3c5a1050d4396302","78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff","d1c9c12e08c8e2111da989e2318b1c42","d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d","e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6f0b92488eae3ccefc0db7a6b0d652ee","45adc4224d2ae9fd75b19417ca6913515c5222ee","457936c28938616495836c472b3389a0870574bee6a5dc026d5bd14979c6202c","58682ca2a49ed4bfb8d5aaf76cf0fade","b00d58e9ffd784db86e77a6a31c76e1bd58ba79b","ab2f84103e95806b25c6d163d6210a21fb3283cd29dddee917d33e654d733425","7b1cf5fc0bfb1021fe0e14e518c32026","380cd990a9e5aec85233ef1d2635dc04d5a96e6b","d4fc76bf8baae39feec23990857c52199e80265a34faeece0d830eb77645c944","a4331ff805b0a8f2a2892777c224b65e","2c5521077dd1a6f5f3558351370880aee9ab7c71","329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483","fa8117afd2dbd20513522f2f8e991262","f7b876edb8fc0c83fd8b665d3c5a1050d4396302","78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff","d1c9c12e08c8e2111da989e2318b1c42","d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d","e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6f0b92488eae3ccefc0db7a6b0d652ee","45adc4224d2ae9fd75b19417ca6913515c5222ee","457936c28938616495836c472b3389a0870574bee6a5dc026d5bd14979c6202c","58682ca2a49ed4bfb8d5aaf76cf0fade","b00d58e9ffd784db86e77a6a31c76e1bd58ba79b","ab2f84103e95806b25c6d163d6210a21fb3283cd29dddee917d33e654d733425","7b1cf5fc0bfb1021fe0e14e518c32026","380cd990a9e5aec85233ef1d2635dc04d5a96e6b","d4fc76bf8baae39feec23990857c52199e80265a34faeece0d830eb77645c944","a4331ff805b0a8f2a2892777c224b65e","2c5521077dd1a6f5f3558351370880aee9ab7c71","329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483","fa8117afd2dbd20513522f2f8e991262","f7b876edb8fc0c83fd8b665d3c5a1050d4396302","78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff","d1c9c12e08c8e2111da989e2318b1c42","d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d","e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion" OR destinationhostname CONTAINS "l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion" OR destinationhostname CONTAINS "36yvrbzhbzyuzia7qxahsaw2yizcr3heljw2jtde3smyuhkokjnb2sid.onion" OR destinationhostname CONTAINS "rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion" OR destinationhostname CONTAINS "4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion" OR destinationhostname CONTAINS "l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion" OR destinationhostname CONTAINS "36yvrbzhbzyuzia7qxahsaw2yizcr3heljw2jtde3smyuhkokjnb2sid.onion" OR destinationhostname CONTAINS "rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion" OR destinationhostname CONTAINS "4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion" OR destinationhostname CONTAINS "l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion" OR destinationhostname CONTAINS "36yvrbzhbzyuzia7qxahsaw2yizcr3heljw2jtde3smyuhkokjnb2sid.onion" OR destinationhostname CONTAINS "rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion" OR destinationhostname CONTAINS "4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion")
