topic Re: BIOC Rule - CGO V/S Actor_process_image_name in Cortex XDR Discussions

BIOC Rule - CGO V/S Actor_process_image_name

meanmach — Mon, 20 May 2024 14:10:00 GMT

I wanted to understand, if i want to see certain cmdline activities from "x" Process.

Want to know what will be more efficient putting the "x" process in "Causality_actor_process_image_name"

or in "actor_process_image" while creating a BIOC

Re: BIOC Rule - CGO V/S Actor_process_image_name

jmazzeo — Mon, 20 May 2024 20:59:39 GMT

Hi @meanmach, thanks for reaching us using the Live Community.

If you want to monitor the activity of the "X" process, when "X" is the process calling a cmdline for command execution, the right field is "causality_actor_process_image_name". The "causalty" prefix indicates the parent process in the execution chain, and should work in this case.

You can find some interesting information about all the xdr_data dataset fields here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/XDR_DATA-Fields-by-Actor

If this post answers your question, please mark it as the solution.

Re: BIOC Rule - CGO V/S Actor_process_image_name

meanmach — Tue, 21 May 2024 05:27:22 GMT

Thanks a lot for the information however i want to understand if i use the actor_process_image_name field is that logic wrong? as in BIOC rule given by Palo Alto to detect recon Activity via Web shell they have used "actor_process_image_name" = "w3wp.exe"