XQl query to identify software installation attempt and/or launching a software in MacOS

Antony_Chan — Wed, 04 Oct 2023 09:58:50 GMT

Dear community,

As per subject, I'm looking for XQL query that could identify the following:

The idea is to build BIOC rules to raise alert on specific software/application so that we could act upon it.

Please advise.

Thank you.

Re: XQl query to identify software installation attempt and/or launching a software in MacOS

aspatil — Tue, 10 Oct 2023 09:23:44 GMT

Hello Antony,

Thank you for writing to live community!

I am checking in my tenant to get such result. Kindly allow us sometime to provide the details.

Thanks & regards