topic Re: Forensics on deleted files on Endpoint in Cortex XDR Discussions

Forensics on deleted files on Endpoint

Noe.ortega — Tue, 24 Jan 2023 14:33:58 GMT

need to know if XDR has the capability to perform forensics on Endpoint if user deleted any files on computer. If so, how would you go about performing this task.

Re: Forensics on deleted files on Endpoint

eluis — Tue, 24 Jan 2023 14:48:46 GMT

Hi @Noe.ortega

thanks for writing us in LiveCommunity.

with xdr forensic add-on you can recover files that are in the recycle bin which is one of the artifacts covered.

Take into account that forensic add-on wont cover:

Information about files that existed on the endpoint and were deleted before the Cortex XDR agent was installed.

Please you can find more information on:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Forensic-Data-Analysis

I hope this helps,

Luis

Re: Forensics on deleted files on Endpoint

Noe.ortega — Tue, 24 Jan 2023 14:56:45 GMT

i am assuming that users can cover their tracks by clearing the Recycle Bin if they are deleting files on purpose. it would be nice to recover the files but i am really just looking for any logs that would indicate that user maliciously deleted files. You mentioned an "add-on" that would need to be installed prior to someone doing malicious acts on Endpoint. Where would i download this "add-on" and is there a cost to this?

Re: Forensics on deleted files on Endpoint

eluis — Wed, 25 Jan 2023 11:14:46 GMT

Hi @Noe.ortega

in order to perform forensic analysis in CXDR you need to purchase forensic add-on licenses for your endpoints.

In the AMcache artifact you have the details of deleted files and you can recover the deleted files that are still in the recycle bin

Please check:

https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/cortex-xdr-forensics

I hope this helps, please feel free to click on like or mark it as a solution

Luis

Re: Forensics on deleted files on Endpoint

eumbach — Wed, 25 Jan 2023 15:57:47 GMT

You may also use XQL without the need for additional licenses.

File [ action type = delete ] AND Host [ host name = [ [WHATEVERHOST] ] AND Time [ [WHATEVERTIME] ]

This will show the hard deletes as well as soft deletes into the RB.