index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eaf","c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eaf","c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eaf","c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eaf","c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eaf","c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("210f12d1282e90aadb532e7e891cbe4f089ef4f3ec0568dc459fb5d546c95eaf","c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://heavenlygem.com/11.php","http://heavenlygem.com/22.php?5PH8Z")
