topic Alert when a XLL was created/read/deleted in Cortex XDR Discussions

Alert when a XLL was created/read/deleted

RFeyertag — Sat, 06 Aug 2022 18:53:02 GMT

Hello dear community,

what is the best way to setup a query for bioc to get an alert. Maybe correlation rule is a better place for my project?

It should alert, when a XLL File was written or read or deleted.

Should I setup a specific file location in my query or is this not neccasary and I can take any file location? I ask because of the ressources on the client.

Rob

Re: Alert when a XLL was created/read/deleted

bbarmanroy — Mon, 08 Aug 2022 03:21:14 GMT

Hi @RFeyertag , certainly you can do that.

Try playing around with this query:
dataset = xdr_data
| filter agent_hostname = "bbarmanroyWinDemo"
|filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = ENUM.FILE_REMOVE or event_sub_type = ENUM.FILE_RENAME )
|filter action_file_extension in ("txt") and action_file_path in("C:\users\IEUser\Desktop\*","C:\BGinfo\*")