index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("ffb2b2e714229f281add91aca0d57dcf","d4c635f97b6564b904803fc2aabbaed8","89db7b4665cff163931777f091f3b8f5","9b4d4447926c285f0b61cda94cd4c091","3330f0addf70da913f2612a1f4160966","2377e6a74e114629130519fb11307c1e","b916f12792f9fa268151a62fd251f5ba","67bd8ac1e0dbfc1e97dcf3484dc94962","8185f8b26899dc1a3fb21f28a707d416","6bf677c885d35e60469a03a5fbdf9d05","ef8c25e9f2898b3e4d6ae90c8f3326bb","0c7ef9ff1aa6063b2c05d7b6a90ac9e8","3ba67a5955c66e272ce9c0dc7899a303","3a52b545ec52c2690b3b3360e6aeabea","f7c4e2d0af6729d90490bed9ec5529bb","fb61ab7fedb684c5cc911f34e7694b97","0e254a2fe5f2b45e8d46473e1bf4261e","f35ceed9535442d8c54ae2c812981967","531c8cfcb06f317e3d2d6f5244065d0e","72e54b41d47187beed081a19f5f492e9","31fc1f95991734c9b6934aa76ea0937f","53ba97516240b344513be0ebf7bfac12","51e2facc49ca409cb39388e97231db48","cf247e4436d2d44a4f426447fa125de6","73e623a5ed9e8f55131c2e00e9660e8b","31e30f8f40e0f917007a0771b3c671e2","fcc64a48b6182a22952cc237d99d9350","9fa65e48a699f1540c8423844ae0da9f","faf2d569cdaf4e1337d7be27b148e72d","53ba97516240b344513be0ebf7bfac12","df46d8d238eee6e283775ba3be6e73bf","047b511c33587734c658146e7802bd01","0d5a0e3a2ff4d0e216eeac4068a80a79","9e060f032e7b4df22cd0bf3e2402e068","84285525a2ab835d5200daedc331242a","350639460f29536d7e92e7e9616f5927","d7296063bbd8eefa39897972530db644","3d551ad49ad93382a33abe57da0d33c5")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("https://paste.website/p/400c3e4b-a59b-4598-a199-75e848aeaae3.txt","https://raw.githubusercontent.com/kschdsc/blackcap-inject/main/index.js")
