topic Re: Is it possible to search for Macros in Cortex? in Cortex XDR Discussions

Is it possible to search for Macros in Cortex?

Kamal.Kishore — Wed, 15 Dec 2021 19:04:55 GMT

Can Cortex see if macros have been launched on an endpoint, specifically Office Macros?

I tried the "All Actions" query and searched for .doc and .xls files but no luck.

Has anyone tried to search for macros using Cortex query or xql?

Just to clarify, I was trying to hunt for any macro executions seen on our endpoints whether they are malicious or not.

Re: Is it possible to search for Macros in Cortex?

fmoixsante — Wed, 15 Dec 2021 17:49:34 GMT

Hi @Kamal.Kishore

If you know the hash value of macro part of the Excel file, yes. You can use Hash View to search for it, or Query Builder, or XQL queries.

Re: Is it possible to search for Macros in Cortex?

Kamal.Kishore — Wed, 15 Dec 2021 18:04:20 GMT

Ya I wouldn't know the hash value, it would be a general search or audit looking for any Office Macros by their file properties.

Re: Is it possible to search for Macros in Cortex?

fmoixsante — Wed, 15 Dec 2021 18:31:25 GMT

Hi @Kamal.Kishore,

The XDR agent office protection ignores Excel files with no macros and will only report on those with a seemingly malicious macro. What you can do is look in XQL for all executed Excel files.

You could try something like this
dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and actor_process_image_name = "EXCEL.EXE"

Re: Is it possible to search for Macros in Cortex?

Kamal.Kishore — Wed, 15 Dec 2021 19:00:32 GMT

Hi Fmoixsante,

Thank you for your response.

That's a great query to identify where Excel.exe is running but I don't see any data pertaining to macro events.

Re: Is it possible to search for Macros in Cortex?

jcandelaria — Thu, 16 Dec 2021 06:56:55 GMT

Hi Kamal,

Try .xlsm instead.

Re: Is it possible to search for Macros in Cortex?

jcandelaria — Thu, 16 Dec 2021 06:57:28 GMT

Hi Kamal,

Try .xlsm instead.

Thanks

Re: Is it possible to search for Macros in Cortex?

fmoixsante — Thu, 16 Dec 2021 09:43:12 GMT

The query I shared also gives all the files that Excel has opened. The query is just a basic query that you could use and modify as you like.

For instance,

dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and actor_process_command_line contains "xlsm"

I would suggest you check our XQL documentation here and here.

I would also recommend you check our Cortex XDR Walkthrough videos. We have many videos showcasing every part of the Cortex XDR product.