1788364233a:5:{s:6:"status";b:1;s:4:"data";a:10:{i:0;a:2:{i:0;s:66:"c:\program files\cymulate\agent\service\cymulate.agent.service.exe";i:1;s:4:"8943";}i:1;a:2:{i:0;s:32:"c:\windows\system32\schtasks.exe";i:1;s:2:"81";}i:2;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.838\cymulate.agent.executor.exe";i:1;s:2:"75";}i:3;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.828\cymulate.agent.executor.exe";i:1;s:2:"45";}i:4;a:2:{i:0;s:12:"/usr/bin/cat";i:1;s:2:"18";}i:5;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.796\cymulate.agent.executor.exe";i:1;s:1:"7";}i:6;a:2:{i:0;s:30:"c:\windows\system32\pktmon.exe";i:1;s:1:"3";}i:7;a:2:{i:0;s:146:"C:\Program Files\Cymulate\EDR_Attacks\6a7694aa804db2738ab2f8d9\1bc441ac8171fb3512206c7da5958daa_MSTSCDLLHIJACKING_CymulateCredsStealNSpreadWMI.exe";i:1;s:1:"2";}i:8;a:2:{i:0;s:146:"C:\Program Files\Cymulate\EDR_Attacks\6a7694aa804db2738ab2f8d9\26d21f740a91306c2fb511c5edde5f9b_DLLINJECTREFLECTIVEINJECTION_outlookcomobjworm.exe";i:1;s:1:"2";}i:9;a:2:{i:0;s:150:"C:\Program Files\Cymulate\EDR_Attacks\6a7694aa804db2738ab2f8d9\85e1807e92a058042ab6212a1b1bb7c1_MSTSCDLLHIJACKINGDOTNETINJECTION_outlookcomobjworm.exe";i:1;s:1:"2";}}s:11:"data_labels";a:2:{i:0;s:9:"File Path";i:1;s:5:"count";}s:6:"search";s:224:"search ```Events by File Path - User Defined id:140``` index="mss-edr_1f568f8d3c2b42d387f927cf435ecd4d" sourcetype="cynet:alerts" | dedup _time, Path | stats count by Path | sort -count | head 10 | rename Path as "File Path"";s:16:"cache_expiration";i:300;}