topic Cortex XDR XQL query to check which user is elevating access in linux in Cortex XDR Discussions

Cortex XDR XQL query to check which user is elevating access in linux

tejaspatil12 — Tue, 24 Sep 2024 11:47:55 GMT

Hello Team ,

I am trying to write a XQL query to check which user is elevating access in Linux.

can someone please help to write this query ?

Thanks in advance.

#XQL

Re: Cortex XDR XQL query to check which user is elevating access in linux

jmazzeo — Tue, 24 Sep 2024 17:46:30 GMT

Hi @tejaspatil12, thanks for reaching us using the Live Community.

This is a simple example that can help you with your inquiry:

dataset = xdr_data
| filter agent_hostname = "HostName" // If you need to filter one endpoint
| filter actor_process_command_line contains "sudo"
| fields agent_hostname, agent_ip_addresses, actor_process_command_line // Add fields as needed

If this post answers your question, please mark it as the solution.

Re: Cortex XDR XQL query to check which user is elevating access in linux

tejaspatil12 — Wed, 25 Sep 2024 10:38:06 GMT

Thanks @jmazzeo this is giving the list for all command lines.

Can we add the field which user executed it ? so we can get the idea about which user elevated the access

Re: Cortex XDR XQL query to check which user is elevating access in linux

jmazzeo — Wed, 25 Sep 2024 18:59:02 GMT

You can add any fields you need, look at the "field" stage line in the query and keep adding all the required fields.