index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("9fee0de10d34f9e4fd53d5ef5e606b39","2eaa031bae075d1c703c706383bef403ddcb94d332bfe6c1622a76f2d4c9f572","8BE57121A3ECAE9C90CCE4ADF00F2454","35D7204F9582B63B47942A4DF9A55B8825B6D0AF295B641F6257C39F7DDA5F5E","c32d544fe375c3ecf031bdf53f479e26","fe42dc8d01dba7f857a3d9468856e3e177fc87111b2d779e1daeb5f5f4f43546","8104093918B6F2D2004535B24B1533BA","337A646E6F1A641D9471B840EE21BFF858E6BA24538A4F815191BE85E5003E70","6BFBD5CEC2A29ED6FB0780D0007F84B9","F5D7586ECDECAF6E85C0B5865D1BD8280824B5D41A7A93833F8FB7BEFD50FDBE","4b5742ff803d73c6a6b8301e4031ac4a","afd06217edd6cb3d1cbb7510ad26987ba3f7587d5f9d679ba06c587758622e9a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9fee0de10d34f9e4fd53d5ef5e606b39","2eaa031bae075d1c703c706383bef403ddcb94d332bfe6c1622a76f2d4c9f572","8BE57121A3ECAE9C90CCE4ADF00F2454","35D7204F9582B63B47942A4DF9A55B8825B6D0AF295B641F6257C39F7DDA5F5E","c32d544fe375c3ecf031bdf53f479e26","fe42dc8d01dba7f857a3d9468856e3e177fc87111b2d779e1daeb5f5f4f43546","8104093918B6F2D2004535B24B1533BA","337A646E6F1A641D9471B840EE21BFF858E6BA24538A4F815191BE85E5003E70","6BFBD5CEC2A29ED6FB0780D0007F84B9","F5D7586ECDECAF6E85C0B5865D1BD8280824B5D41A7A93833F8FB7BEFD50FDBE","4b5742ff803d73c6a6b8301e4031ac4a","afd06217edd6cb3d1cbb7510ad26987ba3f7587d5f9d679ba06c587758622e9a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9fee0de10d34f9e4fd53d5ef5e606b39","2eaa031bae075d1c703c706383bef403ddcb94d332bfe6c1622a76f2d4c9f572","8BE57121A3ECAE9C90CCE4ADF00F2454","35D7204F9582B63B47942A4DF9A55B8825B6D0AF295B641F6257C39F7DDA5F5E","c32d544fe375c3ecf031bdf53f479e26","fe42dc8d01dba7f857a3d9468856e3e177fc87111b2d779e1daeb5f5f4f43546","8104093918B6F2D2004535B24B1533BA","337A646E6F1A641D9471B840EE21BFF858E6BA24538A4F815191BE85E5003E70","6BFBD5CEC2A29ED6FB0780D0007F84B9","F5D7586ECDECAF6E85C0B5865D1BD8280824B5D41A7A93833F8FB7BEFD50FDBE","4b5742ff803d73c6a6b8301e4031ac4a","afd06217edd6cb3d1cbb7510ad26987ba3f7587d5f9d679ba06c587758622e9a")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("9fee0de10d34f9e4fd53d5ef5e606b39","2eaa031bae075d1c703c706383bef403ddcb94d332bfe6c1622a76f2d4c9f572","8BE57121A3ECAE9C90CCE4ADF00F2454","35D7204F9582B63B47942A4DF9A55B8825B6D0AF295B641F6257C39F7DDA5F5E","c32d544fe375c3ecf031bdf53f479e26","fe42dc8d01dba7f857a3d9468856e3e177fc87111b2d779e1daeb5f5f4f43546","8104093918B6F2D2004535B24B1533BA","337A646E6F1A641D9471B840EE21BFF858E6BA24538A4F815191BE85E5003E70","6BFBD5CEC2A29ED6FB0780D0007F84B9","F5D7586ECDECAF6E85C0B5865D1BD8280824B5D41A7A93833F8FB7BEFD50FDBE","4b5742ff803d73c6a6b8301e4031ac4a","afd06217edd6cb3d1cbb7510ad26987ba3f7587d5f9d679ba06c587758622e9a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9fee0de10d34f9e4fd53d5ef5e606b39","2eaa031bae075d1c703c706383bef403ddcb94d332bfe6c1622a76f2d4c9f572","8BE57121A3ECAE9C90CCE4ADF00F2454","35D7204F9582B63B47942A4DF9A55B8825B6D0AF295B641F6257C39F7DDA5F5E","c32d544fe375c3ecf031bdf53f479e26","fe42dc8d01dba7f857a3d9468856e3e177fc87111b2d779e1daeb5f5f4f43546","8104093918B6F2D2004535B24B1533BA","337A646E6F1A641D9471B840EE21BFF858E6BA24538A4F815191BE85E5003E70","6BFBD5CEC2A29ED6FB0780D0007F84B9","F5D7586ECDECAF6E85C0B5865D1BD8280824B5D41A7A93833F8FB7BEFD50FDBE","4b5742ff803d73c6a6b8301e4031ac4a","afd06217edd6cb3d1cbb7510ad26987ba3f7587d5f9d679ba06c587758622e9a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9fee0de10d34f9e4fd53d5ef5e606b39","2eaa031bae075d1c703c706383bef403ddcb94d332bfe6c1622a76f2d4c9f572","8BE57121A3ECAE9C90CCE4ADF00F2454","35D7204F9582B63B47942A4DF9A55B8825B6D0AF295B641F6257C39F7DDA5F5E","c32d544fe375c3ecf031bdf53f479e26","fe42dc8d01dba7f857a3d9468856e3e177fc87111b2d779e1daeb5f5f4f43546","8104093918B6F2D2004535B24B1533BA","337A646E6F1A641D9471B840EE21BFF858E6BA24538A4F815191BE85E5003E70","6BFBD5CEC2A29ED6FB0780D0007F84B9","F5D7586ECDECAF6E85C0B5865D1BD8280824B5D41A7A93833F8FB7BEFD50FDBE","4b5742ff803d73c6a6b8301e4031ac4a","afd06217edd6cb3d1cbb7510ad26987ba3f7587d5f9d679ba06c587758622e9a")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://drive.google.com/file/d/1gm_jkT6Fga7F9m_0dzPcWBg3bXZMiiQC/view?usp=drive_web","https://a.pomf.cat/gectpe.rar")
