index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "amibios-updater.com" OR destinationhostname CONTAINS "vagenor.space")
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND resourcecustomfield1 CONTAINS "StartW"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND resourcecustomfield1 CONTAINS "{18382323-6bd8-41b5-aa5e-d3159cabddce}"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND destinationprocessname = "mstsc.exe" AND sourceprocessname="rundll32.exe"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND destinationprocessname = "adfind.exe"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND resourcecustomfield1 contains "programdata" AND resourcecustomfield1 contains shares resourcecustomfield1 contains ".txt"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND sourceprocessname="mstsc.exe"  AND destinationprocessname = "cmd.exe" 
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND sourceprocessname="mstsc.exe"  AND destinationprocessname = "rundll32.exe"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND sourceprocessname="mstsc.exe"  AND destinationprocessname = "whoami.exe"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND destinationprocessname = "svchost.exe"  AND resourcecustomfield1 contains "entrypoint" AND resourcecustomfield1 contains "appdata\local\temp"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid=1 OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND (resourcecustomfield8 ENDS WITH "SRUtility.exe" OR resourcecustomfield8 ENDS WITH "AnyDesk.exe" OR resourcecustomfield8 ENDS WITH "AnyDeskMSI.exe" OR resourcecustomfield8 ENDS WITH "AteraAgent.exe" OR resourcecustomfield8 ENDS WITH "AgentPackageSTRemote.exe" OR resourcecustomfield8 ENDS WITH "AgentPackageHeartbeat.exe" OR resourcecustomfield8 ENDS WITH "AgentPackageWindowsUpdate.exe" OR resourcecustomfield8 ENDS WITH "AgentPackageADRemote.exe")
