index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811","1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466","1e8261104cbe4e09c19af7910f83e9545fd435483f24f60ec70c3186b98603cc","c213b60a63da80f960e7a7344f478eb1b72cee89fd0145361a088478c51b2c0e","2bf088955007b4f47fe9187affe65fffea234ff16596313a74958a7c85129172","d9e7325f266eda94bfa8b8938de7b7957734041a055b49b94af0627bd119c51c","fc0b7ad2ae9347d6d2ababe2947ffb9f7cc73030","71b4b9f105de94090fc36d9226faaa1db6d9f3d1","6a8f63c4491adcf2cf7f76cd1481c5647615a6c9","a3ecf1fdc1206e9d3061530fa91775cf3d97f788","ae01ca2cf0dc07abb3a7bef9930e38c9212975d5","66b39f4fd1dd51c2f548330e5818f732dad0aa28","a442135c04dd2c9cbf26b2a85264d31a5ac4ec5d2069a7b63bc14b64a6dd82b7","6ec4eb883752b70db134ac0f4e0d5b4a77196184","ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b","afbdb13d8f620d0a5599cbc7a7d9ce8001ee32f1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811","1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466","1e8261104cbe4e09c19af7910f83e9545fd435483f24f60ec70c3186b98603cc","c213b60a63da80f960e7a7344f478eb1b72cee89fd0145361a088478c51b2c0e","2bf088955007b4f47fe9187affe65fffea234ff16596313a74958a7c85129172","d9e7325f266eda94bfa8b8938de7b7957734041a055b49b94af0627bd119c51c","fc0b7ad2ae9347d6d2ababe2947ffb9f7cc73030","71b4b9f105de94090fc36d9226faaa1db6d9f3d1","6a8f63c4491adcf2cf7f76cd1481c5647615a6c9","a3ecf1fdc1206e9d3061530fa91775cf3d97f788","ae01ca2cf0dc07abb3a7bef9930e38c9212975d5","66b39f4fd1dd51c2f548330e5818f732dad0aa28","a442135c04dd2c9cbf26b2a85264d31a5ac4ec5d2069a7b63bc14b64a6dd82b7","6ec4eb883752b70db134ac0f4e0d5b4a77196184","ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b","afbdb13d8f620d0a5599cbc7a7d9ce8001ee32f1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811","1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466","1e8261104cbe4e09c19af7910f83e9545fd435483f24f60ec70c3186b98603cc","c213b60a63da80f960e7a7344f478eb1b72cee89fd0145361a088478c51b2c0e","2bf088955007b4f47fe9187affe65fffea234ff16596313a74958a7c85129172","d9e7325f266eda94bfa8b8938de7b7957734041a055b49b94af0627bd119c51c","fc0b7ad2ae9347d6d2ababe2947ffb9f7cc73030","71b4b9f105de94090fc36d9226faaa1db6d9f3d1","6a8f63c4491adcf2cf7f76cd1481c5647615a6c9","a3ecf1fdc1206e9d3061530fa91775cf3d97f788","ae01ca2cf0dc07abb3a7bef9930e38c9212975d5","66b39f4fd1dd51c2f548330e5818f732dad0aa28","a442135c04dd2c9cbf26b2a85264d31a5ac4ec5d2069a7b63bc14b64a6dd82b7","6ec4eb883752b70db134ac0f4e0d5b4a77196184","ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b","afbdb13d8f620d0a5599cbc7a7d9ce8001ee32f1")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811","1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466","1e8261104cbe4e09c19af7910f83e9545fd435483f24f60ec70c3186b98603cc","c213b60a63da80f960e7a7344f478eb1b72cee89fd0145361a088478c51b2c0e","2bf088955007b4f47fe9187affe65fffea234ff16596313a74958a7c85129172","d9e7325f266eda94bfa8b8938de7b7957734041a055b49b94af0627bd119c51c","fc0b7ad2ae9347d6d2ababe2947ffb9f7cc73030","71b4b9f105de94090fc36d9226faaa1db6d9f3d1","6a8f63c4491adcf2cf7f76cd1481c5647615a6c9","a3ecf1fdc1206e9d3061530fa91775cf3d97f788","ae01ca2cf0dc07abb3a7bef9930e38c9212975d5","66b39f4fd1dd51c2f548330e5818f732dad0aa28","a442135c04dd2c9cbf26b2a85264d31a5ac4ec5d2069a7b63bc14b64a6dd82b7","6ec4eb883752b70db134ac0f4e0d5b4a77196184","ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b","afbdb13d8f620d0a5599cbc7a7d9ce8001ee32f1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811","1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466","1e8261104cbe4e09c19af7910f83e9545fd435483f24f60ec70c3186b98603cc","c213b60a63da80f960e7a7344f478eb1b72cee89fd0145361a088478c51b2c0e","2bf088955007b4f47fe9187affe65fffea234ff16596313a74958a7c85129172","d9e7325f266eda94bfa8b8938de7b7957734041a055b49b94af0627bd119c51c","fc0b7ad2ae9347d6d2ababe2947ffb9f7cc73030","71b4b9f105de94090fc36d9226faaa1db6d9f3d1","6a8f63c4491adcf2cf7f76cd1481c5647615a6c9","a3ecf1fdc1206e9d3061530fa91775cf3d97f788","ae01ca2cf0dc07abb3a7bef9930e38c9212975d5","66b39f4fd1dd51c2f548330e5818f732dad0aa28","a442135c04dd2c9cbf26b2a85264d31a5ac4ec5d2069a7b63bc14b64a6dd82b7","6ec4eb883752b70db134ac0f4e0d5b4a77196184","ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b","afbdb13d8f620d0a5599cbc7a7d9ce8001ee32f1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3b548a851fb889d3cc84243eb8ce9cbf8a857c7d725a24408934c0d8342d5811","1dd03c4ea4d630a59f73e053d705185e27e2e2545dd9caedb26a824ac5d11466","1e8261104cbe4e09c19af7910f83e9545fd435483f24f60ec70c3186b98603cc","c213b60a63da80f960e7a7344f478eb1b72cee89fd0145361a088478c51b2c0e","2bf088955007b4f47fe9187affe65fffea234ff16596313a74958a7c85129172","d9e7325f266eda94bfa8b8938de7b7957734041a055b49b94af0627bd119c51c","fc0b7ad2ae9347d6d2ababe2947ffb9f7cc73030","71b4b9f105de94090fc36d9226faaa1db6d9f3d1","6a8f63c4491adcf2cf7f76cd1481c5647615a6c9","a3ecf1fdc1206e9d3061530fa91775cf3d97f788","ae01ca2cf0dc07abb3a7bef9930e38c9212975d5","66b39f4fd1dd51c2f548330e5818f732dad0aa28","a442135c04dd2c9cbf26b2a85264d31a5ac4ec5d2069a7b63bc14b64a6dd82b7","6ec4eb883752b70db134ac0f4e0d5b4a77196184","ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b","afbdb13d8f620d0a5599cbc7a7d9ce8001ee32f1")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("://www.xbhp.com/dominargreatasianodyssey/wp-content/plugins/akismet/style.php","hxxps://www.c4csa.org/includes/sources/felims.php")
