index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("63d7b35ca907673634ea66e73d6a38486b0b043f3d511ec2d2209597c7898ae8","b0b0cb50456a989114468733428ca9ef8096b18bce256634811ddf81f2119274","a98e108588e31f40cdaeab1c04d0a394eb35a2e151f95fbf8a913cba6a7faa63","2d88db4098a72cd9cb58a760e6a019f6e1587b7b03d4f074c979e776ce110403","a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("63d7b35ca907673634ea66e73d6a38486b0b043f3d511ec2d2209597c7898ae8","b0b0cb50456a989114468733428ca9ef8096b18bce256634811ddf81f2119274","a98e108588e31f40cdaeab1c04d0a394eb35a2e151f95fbf8a913cba6a7faa63","2d88db4098a72cd9cb58a760e6a019f6e1587b7b03d4f074c979e776ce110403","a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("63d7b35ca907673634ea66e73d6a38486b0b043f3d511ec2d2209597c7898ae8","b0b0cb50456a989114468733428ca9ef8096b18bce256634811ddf81f2119274","a98e108588e31f40cdaeab1c04d0a394eb35a2e151f95fbf8a913cba6a7faa63","2d88db4098a72cd9cb58a760e6a019f6e1587b7b03d4f074c979e776ce110403","a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("63d7b35ca907673634ea66e73d6a38486b0b043f3d511ec2d2209597c7898ae8","b0b0cb50456a989114468733428ca9ef8096b18bce256634811ddf81f2119274","a98e108588e31f40cdaeab1c04d0a394eb35a2e151f95fbf8a913cba6a7faa63","2d88db4098a72cd9cb58a760e6a019f6e1587b7b03d4f074c979e776ce110403","a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("63d7b35ca907673634ea66e73d6a38486b0b043f3d511ec2d2209597c7898ae8","b0b0cb50456a989114468733428ca9ef8096b18bce256634811ddf81f2119274","a98e108588e31f40cdaeab1c04d0a394eb35a2e151f95fbf8a913cba6a7faa63","2d88db4098a72cd9cb58a760e6a019f6e1587b7b03d4f074c979e776ce110403","a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("63d7b35ca907673634ea66e73d6a38486b0b043f3d511ec2d2209597c7898ae8","b0b0cb50456a989114468733428ca9ef8096b18bce256634811ddf81f2119274","a98e108588e31f40cdaeab1c04d0a394eb35a2e151f95fbf8a913cba6a7faa63","2d88db4098a72cd9cb58a760e6a019f6e1587b7b03d4f074c979e776ce110403","a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "68468438438.xyz" OR destinationhostname CONTAINS "update-0019992.ru" OR destinationhostname CONTAINS "380222001.xyz")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "68468438438.xyz" OR destinationhostname CONTAINS "update-0019992.ru" OR destinationhostname CONTAINS "380222001.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "68468438438.xyz" OR destinationhostname CONTAINS "update-0019992.ru" OR destinationhostname CONTAINS "380222001.xyz")
