BIOC rule

Anirudha_Jadhav — Mon, 08 Jan 2024 18:18:34 GMT

How to make BIOC rule in cortex xdr if an attacker tries to upload data to aws from PowerShell CLI?

Re: BIOC rule

nsinghvirk — Fri, 12 Jan 2024 14:41:04 GMT

Thanks for reaching out on LiveCommunity!

You can use the Network entity within query builder which provides you with pre build format in order to search network activity by IP address, port, host name, protocol, and more. In addition to network activity you can add acting process where you can define the Powershell parameters like command line, path, SHA256 etc in order to capture powershell details.

Apart from it you can take help from query library by searching for "upload" keyword. There are several prebuilt queries to detect data upload. You can take reference from them and build you own.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: BIOC rule

nsinghvirk — Tue, 16 Jan 2024 14:58:16 GMT

Hello @Anirudha_Jadhav

Please share the XQL query of the BIOC rule. You can get it by going to BIOC rule and then right click to Open in XQL.

topic Re: BIOC rule in Cortex XDR Discussions

BIOC rule

Re: BIOC rule

Re: BIOC rule