index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("207.32.217.89","91.243.32.13","185.112.83.21","23.88.11.67","178.20.44.131","91.243.32.94","95.143.177.66","45.147.230.234","31.42.191.60","135.181.177.210","91.219.63.60")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("15FE4385A2289AAF208F080ABB7277332EF8E71EDC68902709AB917945A36740","891aba61b8fec4005f25d405ddfec4d445213c77fce1e967ba07f13bcbe0dad5","216a733c391337fa303907a15fa55f01c9aeb128365fb6d6d245f7c7ec774100","73942b1b5a8146090a40fe50a67c7c86c739329506db9ff5adc638ed7bb1654e","2af009cdf12e1f84f161a2d4f2b4f97155eb6ec6230265604edbc8b21afb5f1a","bf31d8b83e50a7af3e2dc746c74b85d64ce28d7c33b95c09cd46b9caa4d53cad","b8ebdc5b1e33b9382433151f62464d3860cf8c8950d2f1a0278ef77679a04d3b","8d7883edc608a3806bc4ca58637e0d06a83f784da4e1804e9c5f24676a532a7e","1b4fcd8497e6003009010a19abaa8981366922be96e93a84e30ca2885476ccd7","fdeadd54dd29fe51b251242795c83c4defcdade23fdb4b589c05939ae42d6900","af4bf44056fc0b8c538e1e677ed1453d1dd884e78e1d66d1d2b83abb79ff1161")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15FE4385A2289AAF208F080ABB7277332EF8E71EDC68902709AB917945A36740","891aba61b8fec4005f25d405ddfec4d445213c77fce1e967ba07f13bcbe0dad5","216a733c391337fa303907a15fa55f01c9aeb128365fb6d6d245f7c7ec774100","73942b1b5a8146090a40fe50a67c7c86c739329506db9ff5adc638ed7bb1654e","2af009cdf12e1f84f161a2d4f2b4f97155eb6ec6230265604edbc8b21afb5f1a","bf31d8b83e50a7af3e2dc746c74b85d64ce28d7c33b95c09cd46b9caa4d53cad","b8ebdc5b1e33b9382433151f62464d3860cf8c8950d2f1a0278ef77679a04d3b","8d7883edc608a3806bc4ca58637e0d06a83f784da4e1804e9c5f24676a532a7e","1b4fcd8497e6003009010a19abaa8981366922be96e93a84e30ca2885476ccd7","fdeadd54dd29fe51b251242795c83c4defcdade23fdb4b589c05939ae42d6900","af4bf44056fc0b8c538e1e677ed1453d1dd884e78e1d66d1d2b83abb79ff1161")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15FE4385A2289AAF208F080ABB7277332EF8E71EDC68902709AB917945A36740","891aba61b8fec4005f25d405ddfec4d445213c77fce1e967ba07f13bcbe0dad5","216a733c391337fa303907a15fa55f01c9aeb128365fb6d6d245f7c7ec774100","73942b1b5a8146090a40fe50a67c7c86c739329506db9ff5adc638ed7bb1654e","2af009cdf12e1f84f161a2d4f2b4f97155eb6ec6230265604edbc8b21afb5f1a","bf31d8b83e50a7af3e2dc746c74b85d64ce28d7c33b95c09cd46b9caa4d53cad","b8ebdc5b1e33b9382433151f62464d3860cf8c8950d2f1a0278ef77679a04d3b","8d7883edc608a3806bc4ca58637e0d06a83f784da4e1804e9c5f24676a532a7e","1b4fcd8497e6003009010a19abaa8981366922be96e93a84e30ca2885476ccd7","fdeadd54dd29fe51b251242795c83c4defcdade23fdb4b589c05939ae42d6900","af4bf44056fc0b8c538e1e677ed1453d1dd884e78e1d66d1d2b83abb79ff1161")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("15FE4385A2289AAF208F080ABB7277332EF8E71EDC68902709AB917945A36740","891aba61b8fec4005f25d405ddfec4d445213c77fce1e967ba07f13bcbe0dad5","216a733c391337fa303907a15fa55f01c9aeb128365fb6d6d245f7c7ec774100","73942b1b5a8146090a40fe50a67c7c86c739329506db9ff5adc638ed7bb1654e","2af009cdf12e1f84f161a2d4f2b4f97155eb6ec6230265604edbc8b21afb5f1a","bf31d8b83e50a7af3e2dc746c74b85d64ce28d7c33b95c09cd46b9caa4d53cad","b8ebdc5b1e33b9382433151f62464d3860cf8c8950d2f1a0278ef77679a04d3b","8d7883edc608a3806bc4ca58637e0d06a83f784da4e1804e9c5f24676a532a7e","1b4fcd8497e6003009010a19abaa8981366922be96e93a84e30ca2885476ccd7","fdeadd54dd29fe51b251242795c83c4defcdade23fdb4b589c05939ae42d6900","af4bf44056fc0b8c538e1e677ed1453d1dd884e78e1d66d1d2b83abb79ff1161")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15FE4385A2289AAF208F080ABB7277332EF8E71EDC68902709AB917945A36740","891aba61b8fec4005f25d405ddfec4d445213c77fce1e967ba07f13bcbe0dad5","216a733c391337fa303907a15fa55f01c9aeb128365fb6d6d245f7c7ec774100","73942b1b5a8146090a40fe50a67c7c86c739329506db9ff5adc638ed7bb1654e","2af009cdf12e1f84f161a2d4f2b4f97155eb6ec6230265604edbc8b21afb5f1a","bf31d8b83e50a7af3e2dc746c74b85d64ce28d7c33b95c09cd46b9caa4d53cad","b8ebdc5b1e33b9382433151f62464d3860cf8c8950d2f1a0278ef77679a04d3b","8d7883edc608a3806bc4ca58637e0d06a83f784da4e1804e9c5f24676a532a7e","1b4fcd8497e6003009010a19abaa8981366922be96e93a84e30ca2885476ccd7","fdeadd54dd29fe51b251242795c83c4defcdade23fdb4b589c05939ae42d6900","af4bf44056fc0b8c538e1e677ed1453d1dd884e78e1d66d1d2b83abb79ff1161")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15FE4385A2289AAF208F080ABB7277332EF8E71EDC68902709AB917945A36740","891aba61b8fec4005f25d405ddfec4d445213c77fce1e967ba07f13bcbe0dad5","216a733c391337fa303907a15fa55f01c9aeb128365fb6d6d245f7c7ec774100","73942b1b5a8146090a40fe50a67c7c86c739329506db9ff5adc638ed7bb1654e","2af009cdf12e1f84f161a2d4f2b4f97155eb6ec6230265604edbc8b21afb5f1a","bf31d8b83e50a7af3e2dc746c74b85d64ce28d7c33b95c09cd46b9caa4d53cad","b8ebdc5b1e33b9382433151f62464d3860cf8c8950d2f1a0278ef77679a04d3b","8d7883edc608a3806bc4ca58637e0d06a83f784da4e1804e9c5f24676a532a7e","1b4fcd8497e6003009010a19abaa8981366922be96e93a84e30ca2885476ccd7","fdeadd54dd29fe51b251242795c83c4defcdade23fdb4b589c05939ae42d6900","af4bf44056fc0b8c538e1e677ed1453d1dd884e78e1d66d1d2b83abb79ff1161")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://privatlab.com/s/s/nRqOogoYkXT3anz2kbrO/2f6ceecb-a469-40b5-94a2-2c9cc0bc8445-Ewdy5l6RAylbLsgDgrgjNjVbn","https://privatlab.com/s/s/3Qa0YRMaVaij07Z8BqzZ/7ca69d4c-c5bb-4ab3-b5a9-87c17b7167b5-86yYgEGqbQMnoszgm0OmgGb6g","http://data-host-coin-8.com/files/9476_1641477642_2883.exe","http://data-host-coin-8.com/files/541_1641407973_7515.exe","http://data-host-coin-8.com/files/7871_1641415744_5762.exe","https://transfer.sh/get/HafwDG/rednovi.exe")
