index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND (resourcecustomfield8  CONTAINS "\AppData\Roaming\" OR resourcecustomfield8  CONTAINS "\AppData\Local\Temp\") AND  (destinationprocessname ENDS WITH "NTLDR.exe" OR destinationprocessname ENDS WITH "Runtime Broker.exe" destinationprocessname ENDS WITH "WMI.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND (resourcecustomfield8  CONTAINS ("\AppData\Roaming\" OR resourcecustomfield8  CONTAINS "\AppData\Local\Temp\") AND destinationhostname = "ip-api.com"
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND baseeventid = "1" AND (resourcecustomfield8  CONTAINS "\AppData\Roaming\" OR resourcecustomfield8  CONTAINS "\AppData\Local\Temp\") AND  (destinationprocessname ENDS WITH "NTLDR.exe" OR destinationprocessname ENDS WITH "Runtime Broker.exe" destinationprocessname ENDS WITH "WMI.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND baseeventid = "1" AND (resourcecustomfield8  CONTAINS ("\AppData\Roaming\" OR resourcecustomfield8  CONTAINS "\AppData\Local\Temp\") AND destinationhostname = "ip-api.com"
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND baseeventid = "1" AND (resourcecustomfield8  CONTAINS "\AppData\Roaming\" OR resourcecustomfield8  CONTAINS "\AppData\Local\Temp\") AND  (destinationprocessname ENDS WITH "NTLDR.exe" OR destinationprocessname ENDS WITH "Runtime Broker.exe" destinationprocessname ENDS WITH "WMI.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND baseeventid = "1" AND (resourcecustomfield8  CONTAINS ("\AppData\Roaming\" OR resourcecustomfield8  CONTAINS "\AppData\Local\Temp\") AND destinationhostname = "ip-api.com"
