index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid = "11" OR deviceaction="PeFileWritten" OR deviceaction="JarFileWritten" OR deviceaction="MachOFileWritten" OR deviceaction="OoxmlFileWritten" OR deviceaction="ZipFileWritten" OR deviceaction="OleFileWritten" OR deviceaction="DmpFileWritten" OR deviceaction="PdfFileWritten" OR deviceaction="GenericFileWritten" OR deviceaction="RtfFileWritten" OR deviceaction="BZip2FileWritten" OR deviceaction="XarFileWritten" OR deviceaction="SevenZipFileWritten" OR deviceaction="TarFileWritten" OR deviceaction="DwgFileWritten" OR deviceaction="RarFileWritten" OR deviceaction="IdwFileWritten" OR deviceaction="SuspiciousEseFileWritten") AND resourcecustomfield5 contains "\AppData\Roaming\netfilter.sys"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction="PeFileWritten" OR deviceaction="JarFileWritten" OR deviceaction="MachOFileWritten" OR deviceaction="OoxmlFileWritten" OR deviceaction="ZipFileWritten" OR deviceaction="OleFileWritten" OR deviceaction="DmpFileWritten" OR deviceaction="PdfFileWritten" OR deviceaction="GenericFileWritten" OR deviceaction="RtfFileWritten" OR deviceaction="BZip2FileWritten" OR deviceaction="XarFileWritten" OR deviceaction="SevenZipFileWritten" OR deviceaction="TarFileWritten" OR deviceaction="DwgFileWritten" OR deviceaction="RarFileWritten" OR deviceaction="IdwFileWritten" OR deviceaction="SuspiciousEseFileWritten" OR deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process" or baseeventid=1 or baseeventid=11) AND resourcecustomfield5 contains "\AppData\Roaming\netfilter.sys"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid = "1" OR deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND destinationprocessname = "regini.exe" AND resourcecustomfield1 contains ".calm"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process" or baseeventid=1 or baseeventid=11 OR deviceaction="PeFileWritten" OR deviceaction="JarFileWritten" OR deviceaction="MachOFileWritten" OR deviceaction="OoxmlFileWritten" OR deviceaction="ZipFileWritten" OR deviceaction="OleFileWritten" OR deviceaction="DmpFileWritten" OR deviceaction="PdfFileWritten" OR deviceaction="GenericFileWritten" OR deviceaction="RtfFileWritten" OR deviceaction="BZip2FileWritten" OR deviceaction="XarFileWritten" OR deviceaction="SevenZipFileWritten" OR deviceaction="TarFileWritten" OR deviceaction="DwgFileWritten" OR deviceaction="RarFileWritten" OR deviceaction="IdwFileWritten" OR deviceaction="SuspiciousEseFileWritten") AND destinationprocessname="regini.exe" AND resourcecustomfield1 contains ".calm"
