index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("819b1896050b11f6ffdd835f6249874e","ce4daac8f83a34a43b75073dcb9a17806cc47a91c2f0fba1017ee636feff53a7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("819b1896050b11f6ffdd835f6249874e","ce4daac8f83a34a43b75073dcb9a17806cc47a91c2f0fba1017ee636feff53a7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("819b1896050b11f6ffdd835f6249874e","ce4daac8f83a34a43b75073dcb9a17806cc47a91c2f0fba1017ee636feff53a7")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("819b1896050b11f6ffdd835f6249874e","ce4daac8f83a34a43b75073dcb9a17806cc47a91c2f0fba1017ee636feff53a7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("819b1896050b11f6ffdd835f6249874e","ce4daac8f83a34a43b75073dcb9a17806cc47a91c2f0fba1017ee636feff53a7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("819b1896050b11f6ffdd835f6249874e","ce4daac8f83a34a43b75073dcb9a17806cc47a91c2f0fba1017ee636feff53a7")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "www.zozter.com" OR destinationhostname CONTAINS "103.124.106.149")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "www.zozter.com" OR destinationhostname CONTAINS "103.124.106.149")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "www.zozter.com" OR destinationhostname CONTAINS "103.124.106.149")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://www.zozter.com/tracking/tracking.php","http://103.124.106.149/images/soccer.png")
