index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("45c94900f312b2002c9c445bd8a59ae6","d8a57534382a07cc0487b96350bca761","d52d6bad3d11e9a72998608ccca572f5","d66740b3ed3884c31d40e3747684411e","43660f882cc5971ab83a810398487317","192b8ee95537dda7927ba3b45183e6a4","1ae425ac2890283ddcf11946e7e8f6ae","20621960888a6299123ce5a2df5eabba","27b62f7b4b285b880b8c81960aa60b15","2d15a4c9184878e25bdf108bd58290b8","37bbbbc44c80ff4fe770ce78f6a37ebd","603b1cc2d5488dcd8bb0a3b14429c88b","62c8efb35b3b9c10e965ec5a236fed2d","a948e8d3222b9fa8ccbd091230098b78","ecdb2860af9ce2754d178c80e3303080","fe84ead033bfeaee70f84d8733b51e08","04fc0ca4062dd014d64dcb2fe8dbc966","eb8b1d64429e00f2b3b49f886ee3b0b4","41c0bb6e89ad89af8eef7bec40d4acbb","302207c3248257d4d9badf4bc4b75483","6d3e8a2802848d259a3baaaa78701b97","b8e9ce084d9d49f565f850c59b003bcf","723f5e75239b66e3d08b83a131c7b66c","f174c03d177a04e81677e9c9a9eae0c8","cf45b793bc9ec86bfedfa165c01ede15","de2ff99ca086a8ad0f9b8027aef696ba","73790d28f4f8f0f4c402da66c8dc393f","23c5bc4a2e69c3f171561b524ceb4098","4def35aedc86a946c13118e14127e0e9","85c700ff566161c77a03f282fa48a246","7870a7c7e355d1fbf357c846d8bf2aea","4023e57ffbc87aa93621a7c2a6f0b425")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("45c94900f312b2002c9c445bd8a59ae6","d8a57534382a07cc0487b96350bca761","d52d6bad3d11e9a72998608ccca572f5","d66740b3ed3884c31d40e3747684411e","43660f882cc5971ab83a810398487317","192b8ee95537dda7927ba3b45183e6a4","1ae425ac2890283ddcf11946e7e8f6ae","20621960888a6299123ce5a2df5eabba","27b62f7b4b285b880b8c81960aa60b15","2d15a4c9184878e25bdf108bd58290b8","37bbbbc44c80ff4fe770ce78f6a37ebd","603b1cc2d5488dcd8bb0a3b14429c88b","62c8efb35b3b9c10e965ec5a236fed2d","a948e8d3222b9fa8ccbd091230098b78","ecdb2860af9ce2754d178c80e3303080","fe84ead033bfeaee70f84d8733b51e08","04fc0ca4062dd014d64dcb2fe8dbc966","eb8b1d64429e00f2b3b49f886ee3b0b4","41c0bb6e89ad89af8eef7bec40d4acbb","302207c3248257d4d9badf4bc4b75483","6d3e8a2802848d259a3baaaa78701b97","b8e9ce084d9d49f565f850c59b003bcf","723f5e75239b66e3d08b83a131c7b66c","f174c03d177a04e81677e9c9a9eae0c8","cf45b793bc9ec86bfedfa165c01ede15","de2ff99ca086a8ad0f9b8027aef696ba","73790d28f4f8f0f4c402da66c8dc393f","23c5bc4a2e69c3f171561b524ceb4098","4def35aedc86a946c13118e14127e0e9","85c700ff566161c77a03f282fa48a246","7870a7c7e355d1fbf357c846d8bf2aea","4023e57ffbc87aa93621a7c2a6f0b425")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("45c94900f312b2002c9c445bd8a59ae6","d8a57534382a07cc0487b96350bca761","d52d6bad3d11e9a72998608ccca572f5","d66740b3ed3884c31d40e3747684411e","43660f882cc5971ab83a810398487317","192b8ee95537dda7927ba3b45183e6a4","1ae425ac2890283ddcf11946e7e8f6ae","20621960888a6299123ce5a2df5eabba","27b62f7b4b285b880b8c81960aa60b15","2d15a4c9184878e25bdf108bd58290b8","37bbbbc44c80ff4fe770ce78f6a37ebd","603b1cc2d5488dcd8bb0a3b14429c88b","62c8efb35b3b9c10e965ec5a236fed2d","a948e8d3222b9fa8ccbd091230098b78","ecdb2860af9ce2754d178c80e3303080","fe84ead033bfeaee70f84d8733b51e08","04fc0ca4062dd014d64dcb2fe8dbc966","eb8b1d64429e00f2b3b49f886ee3b0b4","41c0bb6e89ad89af8eef7bec40d4acbb","302207c3248257d4d9badf4bc4b75483","6d3e8a2802848d259a3baaaa78701b97","b8e9ce084d9d49f565f850c59b003bcf","723f5e75239b66e3d08b83a131c7b66c","f174c03d177a04e81677e9c9a9eae0c8","cf45b793bc9ec86bfedfa165c01ede15","de2ff99ca086a8ad0f9b8027aef696ba","73790d28f4f8f0f4c402da66c8dc393f","23c5bc4a2e69c3f171561b524ceb4098","4def35aedc86a946c13118e14127e0e9","85c700ff566161c77a03f282fa48a246","7870a7c7e355d1fbf357c846d8bf2aea","4023e57ffbc87aa93621a7c2a6f0b425")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("45c94900f312b2002c9c445bd8a59ae6","d8a57534382a07cc0487b96350bca761","d52d6bad3d11e9a72998608ccca572f5","d66740b3ed3884c31d40e3747684411e","43660f882cc5971ab83a810398487317","192b8ee95537dda7927ba3b45183e6a4","1ae425ac2890283ddcf11946e7e8f6ae","20621960888a6299123ce5a2df5eabba","27b62f7b4b285b880b8c81960aa60b15","2d15a4c9184878e25bdf108bd58290b8","37bbbbc44c80ff4fe770ce78f6a37ebd","603b1cc2d5488dcd8bb0a3b14429c88b","62c8efb35b3b9c10e965ec5a236fed2d","a948e8d3222b9fa8ccbd091230098b78","ecdb2860af9ce2754d178c80e3303080","fe84ead033bfeaee70f84d8733b51e08","04fc0ca4062dd014d64dcb2fe8dbc966","eb8b1d64429e00f2b3b49f886ee3b0b4","41c0bb6e89ad89af8eef7bec40d4acbb","302207c3248257d4d9badf4bc4b75483","6d3e8a2802848d259a3baaaa78701b97","b8e9ce084d9d49f565f850c59b003bcf","723f5e75239b66e3d08b83a131c7b66c","f174c03d177a04e81677e9c9a9eae0c8","cf45b793bc9ec86bfedfa165c01ede15","de2ff99ca086a8ad0f9b8027aef696ba","73790d28f4f8f0f4c402da66c8dc393f","23c5bc4a2e69c3f171561b524ceb4098","4def35aedc86a946c13118e14127e0e9","85c700ff566161c77a03f282fa48a246","7870a7c7e355d1fbf357c846d8bf2aea","4023e57ffbc87aa93621a7c2a6f0b425")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("45c94900f312b2002c9c445bd8a59ae6","d8a57534382a07cc0487b96350bca761","d52d6bad3d11e9a72998608ccca572f5","d66740b3ed3884c31d40e3747684411e","43660f882cc5971ab83a810398487317","192b8ee95537dda7927ba3b45183e6a4","1ae425ac2890283ddcf11946e7e8f6ae","20621960888a6299123ce5a2df5eabba","27b62f7b4b285b880b8c81960aa60b15","2d15a4c9184878e25bdf108bd58290b8","37bbbbc44c80ff4fe770ce78f6a37ebd","603b1cc2d5488dcd8bb0a3b14429c88b","62c8efb35b3b9c10e965ec5a236fed2d","a948e8d3222b9fa8ccbd091230098b78","ecdb2860af9ce2754d178c80e3303080","fe84ead033bfeaee70f84d8733b51e08","04fc0ca4062dd014d64dcb2fe8dbc966","eb8b1d64429e00f2b3b49f886ee3b0b4","41c0bb6e89ad89af8eef7bec40d4acbb","302207c3248257d4d9badf4bc4b75483","6d3e8a2802848d259a3baaaa78701b97","b8e9ce084d9d49f565f850c59b003bcf","723f5e75239b66e3d08b83a131c7b66c","f174c03d177a04e81677e9c9a9eae0c8","cf45b793bc9ec86bfedfa165c01ede15","de2ff99ca086a8ad0f9b8027aef696ba","73790d28f4f8f0f4c402da66c8dc393f","23c5bc4a2e69c3f171561b524ceb4098","4def35aedc86a946c13118e14127e0e9","85c700ff566161c77a03f282fa48a246","7870a7c7e355d1fbf357c846d8bf2aea","4023e57ffbc87aa93621a7c2a6f0b425")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("45c94900f312b2002c9c445bd8a59ae6","d8a57534382a07cc0487b96350bca761","d52d6bad3d11e9a72998608ccca572f5","d66740b3ed3884c31d40e3747684411e","43660f882cc5971ab83a810398487317","192b8ee95537dda7927ba3b45183e6a4","1ae425ac2890283ddcf11946e7e8f6ae","20621960888a6299123ce5a2df5eabba","27b62f7b4b285b880b8c81960aa60b15","2d15a4c9184878e25bdf108bd58290b8","37bbbbc44c80ff4fe770ce78f6a37ebd","603b1cc2d5488dcd8bb0a3b14429c88b","62c8efb35b3b9c10e965ec5a236fed2d","a948e8d3222b9fa8ccbd091230098b78","ecdb2860af9ce2754d178c80e3303080","fe84ead033bfeaee70f84d8733b51e08","04fc0ca4062dd014d64dcb2fe8dbc966","eb8b1d64429e00f2b3b49f886ee3b0b4","41c0bb6e89ad89af8eef7bec40d4acbb","302207c3248257d4d9badf4bc4b75483","6d3e8a2802848d259a3baaaa78701b97","b8e9ce084d9d49f565f850c59b003bcf","723f5e75239b66e3d08b83a131c7b66c","f174c03d177a04e81677e9c9a9eae0c8","cf45b793bc9ec86bfedfa165c01ede15","de2ff99ca086a8ad0f9b8027aef696ba","73790d28f4f8f0f4c402da66c8dc393f","23c5bc4a2e69c3f171561b524ceb4098","4def35aedc86a946c13118e14127e0e9","85c700ff566161c77a03f282fa48a246","7870a7c7e355d1fbf357c846d8bf2aea","4023e57ffbc87aa93621a7c2a6f0b425")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "svhost-system-update.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "svhost-system-update.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "svhost-system-update.net")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://dl4.joxi.net/drive/2021/04/15/0048/3592/3153416/16/b8c104ce64.png","http://dl4.joxi.net/drive/2021/04/19/0048/3592/3153416/16/d07409594a.proj","http://joxi.net/52ap4j7tkJER7m.proj")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="135.181.170.169" AND destinationport=50845) OR (destinationaddress="37.1.206.16" AND destinationport=7575))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="135.181.170.169" AND destinationport=50845) OR (destinationaddress="37.1.206.16" AND destinationport=7575))
