Create a BIOC that doesn't allow a specific folder to be created

AmmarBahasan — Fri, 11 Mar 2022 14:51:43 GMT

Hello,

i want to create a rule that prevent anyone from creating a directory with a specific name in C:\

for example: if we say the folder is named coffee, i don't want this folder directory being created "C:\Coffee" .

i tried to created it, but i couldn't find a way to do a BIOC for folder only for files.

thank you.

Re: Create a BIOC that doesn't allow a specific folder to be created

bbarmanroy — Mon, 14 Mar 2022 05:48:37 GMT

Here's a XQL query to get you alerts if a directory gets created

| dataset = xdr_data
| filter event_type = ENUM.FILE and (event_sub_type = ENUM.FILE_DIR_CREATE or event_sub_type = ENUM.FILE_DIR_RENAME)
| filter action_file_path in("C:\Coffee")

However, you might also want to look at additional controls like: why are users able to create directories in such paths and not under "C:\Users\<username>\", and how those permissions should be reviewed and applied to users.

topic Re: Create a BIOC that doesn't allow a specific folder to be created in Cortex XDR Discussions

Create a BIOC that doesn't allow a specific folder to be created

Re: Create a BIOC that doesn't allow a specific folder to be created