topic Re: XQL question command line with " to XQL query in Cortex XDR Discussions

XQL question command line with " to XQL query

RFeyertag — Wed, 22 Jun 2022 21:21:35 GMT

Hello dear community,

is there a way to put the whole command line into the XQL query? As you can see the doublequotes are already set by the command line itself.

In SQL I know to do it whith extra double quotes ""XYZ"". But how does that work with XQL?

Rob

Re: XQL question command line with " to XQL query

bbarmanroy — Thu, 23 Jun 2022 03:03:00 GMT

@RFeyertag yes you can. Use an leading '\' escape character.

Re: XQL question command line with " to XQL query

RFeyertag — Thu, 23 Jun 2022 19:09:03 GMT

Sorry, I don't get it.

How would you type in, if i want to check exactly following string.

"C:\Windows\System32\hh.exe" C:\Program Files (x86)\ASSA ABLOY\Vision\Vision.chm::/Use_Guest_CheckIn_Steps_Single.htm

Rob

Re: XQL question command line with " to XQL query

SilviuMihailDascalu — Fri, 24 Jun 2022 06:32:57 GMT

Just like @bbarmanroy mentioned in the post you just need to escape the double quotes in the string.

dataset = xdr_data
|filter action_process_image_command_line = "\"C:\Windows\System32\hh.exe\" C:\Program Files (x86)\ASSA ABLOY\Vision\Vision.chm::/Use_Guest_CheckIn_Steps_Single.htm"
|fields action_process_image_command_line