index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid = "11" OR deviceaction="PeFileWritten" OR deviceaction="JarFileWritten" OR deviceaction="MachOFileWritten" OR deviceaction="OoxmlFileWritten" OR deviceaction="ZipFileWritten" OR deviceaction="OleFileWritten" OR deviceaction="DmpFileWritten" OR deviceaction="PdfFileWritten" OR deviceaction="GenericFileWritten" OR deviceaction="RtfFileWritten" OR deviceaction="BZip2FileWritten" OR deviceaction="XarFileWritten" OR deviceaction="SevenZipFileWritten" OR deviceaction="TarFileWritten" OR deviceaction="DwgFileWritten" OR deviceaction="RarFileWritten" OR deviceaction="IdwFileWritten" OR deviceaction="SuspiciousEseFileWritten" OR deviceaction="File Activity: Created" OR deviceaction="Trace File Operations" OR deviceaction="filemod" OR deviceaction="file.added") AND filename ENDS WITH "credwiz.exe"
