index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("39fc804566d02c35f3f9d67be52bee0d","44f7af834ee7387ac5d99a676a03cfdd","4e5583e34ad54fa7d1617f400281ba5","e80dc4c3e26deddcc44e66bb19b6fb5","169c4d96138d3ff73097c2a9aab5b1c0","e70502d020ba707095d46810fd32ee49","62fb99dc271abc104504212157a4ba91","1d3fcb7808495bd403973a0472291da5","6a1da7ee620c638bd494f4e24f6f1ca9","a28236b43f014c15f7ad4c2b4daf1490","d594b3bce66b8b56881febd38aa075fb","4b32115487b4734f2723d461856af155","9e3f7e6697843075de537a8ba83da541","cc17e0a3a15da6a83b06b425ed79d84c","1aeecb2827babb42468d8257aa6afdeb","1bdf780ea6ff3abee41fe9f48d355592","1f285e496096168fbed415e6496a172f","6a3a0d3d239f04ffd0666b522b8fcbaa","ce02ef6efe6171cd5d1b4477e40a3989","fa9e686b811a1d921623947b8fd56337")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("39fc804566d02c35f3f9d67be52bee0d","44f7af834ee7387ac5d99a676a03cfdd","4e5583e34ad54fa7d1617f400281ba5","e80dc4c3e26deddcc44e66bb19b6fb5","169c4d96138d3ff73097c2a9aab5b1c0","e70502d020ba707095d46810fd32ee49","62fb99dc271abc104504212157a4ba91","1d3fcb7808495bd403973a0472291da5","6a1da7ee620c638bd494f4e24f6f1ca9","a28236b43f014c15f7ad4c2b4daf1490","d594b3bce66b8b56881febd38aa075fb","4b32115487b4734f2723d461856af155","9e3f7e6697843075de537a8ba83da541","cc17e0a3a15da6a83b06b425ed79d84c","1aeecb2827babb42468d8257aa6afdeb","1bdf780ea6ff3abee41fe9f48d355592","1f285e496096168fbed415e6496a172f","6a3a0d3d239f04ffd0666b522b8fcbaa","ce02ef6efe6171cd5d1b4477e40a3989","fa9e686b811a1d921623947b8fd56337")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("39fc804566d02c35f3f9d67be52bee0d","44f7af834ee7387ac5d99a676a03cfdd","4e5583e34ad54fa7d1617f400281ba5","e80dc4c3e26deddcc44e66bb19b6fb5","169c4d96138d3ff73097c2a9aab5b1c0","e70502d020ba707095d46810fd32ee49","62fb99dc271abc104504212157a4ba91","1d3fcb7808495bd403973a0472291da5","6a1da7ee620c638bd494f4e24f6f1ca9","a28236b43f014c15f7ad4c2b4daf1490","d594b3bce66b8b56881febd38aa075fb","4b32115487b4734f2723d461856af155","9e3f7e6697843075de537a8ba83da541","cc17e0a3a15da6a83b06b425ed79d84c","1aeecb2827babb42468d8257aa6afdeb","1bdf780ea6ff3abee41fe9f48d355592","1f285e496096168fbed415e6496a172f","6a3a0d3d239f04ffd0666b522b8fcbaa","ce02ef6efe6171cd5d1b4477e40a3989","fa9e686b811a1d921623947b8fd56337")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("39fc804566d02c35f3f9d67be52bee0d","44f7af834ee7387ac5d99a676a03cfdd","4e5583e34ad54fa7d1617f400281ba5","e80dc4c3e26deddcc44e66bb19b6fb5","169c4d96138d3ff73097c2a9aab5b1c0","e70502d020ba707095d46810fd32ee49","62fb99dc271abc104504212157a4ba91","1d3fcb7808495bd403973a0472291da5","6a1da7ee620c638bd494f4e24f6f1ca9","a28236b43f014c15f7ad4c2b4daf1490","d594b3bce66b8b56881febd38aa075fb","4b32115487b4734f2723d461856af155","9e3f7e6697843075de537a8ba83da541","cc17e0a3a15da6a83b06b425ed79d84c","1aeecb2827babb42468d8257aa6afdeb","1bdf780ea6ff3abee41fe9f48d355592","1f285e496096168fbed415e6496a172f","6a3a0d3d239f04ffd0666b522b8fcbaa","ce02ef6efe6171cd5d1b4477e40a3989","fa9e686b811a1d921623947b8fd56337")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("39fc804566d02c35f3f9d67be52bee0d","44f7af834ee7387ac5d99a676a03cfdd","4e5583e34ad54fa7d1617f400281ba5","e80dc4c3e26deddcc44e66bb19b6fb5","169c4d96138d3ff73097c2a9aab5b1c0","e70502d020ba707095d46810fd32ee49","62fb99dc271abc104504212157a4ba91","1d3fcb7808495bd403973a0472291da5","6a1da7ee620c638bd494f4e24f6f1ca9","a28236b43f014c15f7ad4c2b4daf1490","d594b3bce66b8b56881febd38aa075fb","4b32115487b4734f2723d461856af155","9e3f7e6697843075de537a8ba83da541","cc17e0a3a15da6a83b06b425ed79d84c","1aeecb2827babb42468d8257aa6afdeb","1bdf780ea6ff3abee41fe9f48d355592","1f285e496096168fbed415e6496a172f","6a3a0d3d239f04ffd0666b522b8fcbaa","ce02ef6efe6171cd5d1b4477e40a3989","fa9e686b811a1d921623947b8fd56337")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("39fc804566d02c35f3f9d67be52bee0d","44f7af834ee7387ac5d99a676a03cfdd","4e5583e34ad54fa7d1617f400281ba5","e80dc4c3e26deddcc44e66bb19b6fb5","169c4d96138d3ff73097c2a9aab5b1c0","e70502d020ba707095d46810fd32ee49","62fb99dc271abc104504212157a4ba91","1d3fcb7808495bd403973a0472291da5","6a1da7ee620c638bd494f4e24f6f1ca9","a28236b43f014c15f7ad4c2b4daf1490","d594b3bce66b8b56881febd38aa075fb","4b32115487b4734f2723d461856af155","9e3f7e6697843075de537a8ba83da541","cc17e0a3a15da6a83b06b425ed79d84c","1aeecb2827babb42468d8257aa6afdeb","1bdf780ea6ff3abee41fe9f48d355592","1f285e496096168fbed415e6496a172f","6a3a0d3d239f04ffd0666b522b8fcbaa","ce02ef6efe6171cd5d1b4477e40a3989","fa9e686b811a1d921623947b8fd56337")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://p-leh.com/update_java.dat","http://clanvisits.com/mini.dat","https://towncentrehotels.com/ps1.dat","https://klikbets.net/admin/client.php","https://lasartoria.net/admin/client.php","https://barrel1999.com/admin4/client.php","https://widestaticsinfo.com/admin4/client.php","https://secureinternet20.com/admin5/client.php","https://adsinfocoast.com/admin5/client.php")
