topic Re: XQL Command Line Help in Cortex XDR Discussions

XQL Command Line Help

Chris_Dietz — Fri, 23 Jun 2023 16:12:02 GMT

All,

Trying to write a XQL query to search for this Windows command line when executed. Can anyone tell me how to distinguish the command line parameters "domain computers" in XQL? Thanks.

actor_process_command_line = "%systemroot%\system32\net.exe group "domain computers" /domain"

Re: XQL Command Line Help

bbarmanroy — Mon, 26 Jun 2023 01:28:49 GMT

Hi @Chris_Dietz you will need to escape the double-quotes with a leading backslash, as explained here: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-question-command-line-with-quot-to-xql-query/m-p/505630/highlight/true#M2261

Re: XQL Command Line Help

Chris_Dietz — Mon, 26 Jun 2023 11:47:13 GMT

Thanks! I was really scratching my head on that one.