topic Re: Unable to retrive downloaded exe's in Cortex XDR Discussions

Unable to retrive downloaded exe's

Malayamarutham — Tue, 14 Jan 2025 20:33:03 GMT

Hello everyone,

I was trying to check all the downloaded exe's via firewall on all the endpoints in past 24hrs. I tried retrieving all downloaded exe's in downloads folder with the help of this query below.

dataset = xdr_data
| filter event_type = ENUM.FILE
| filter action_file_path contains "Downloads" and action_file_path contains "C:\Users\"

Can anyone help me with this.

Thank you

Re: Unable to retrive downloaded exe's

aspatil — Wed, 15 Jan 2025 17:09:30 GMT

Hello @Malayamarutham ,

Thanks for reaching out on LiveCommunity!

You can try below query as a sample and modify it as per your requirement:

dataset = xdr_data
| filter event_type = File and event_sub_type in (ENUM.FILE_CREATE_NEW , ENUM.FILE_WRITE, ENUM.FILE_RENAME ) and (action_file_path contains """\\Downloads\\""" or action_file_path contains "/Downloads/")
| fields actor_process_image_name, agent_hostname, actor_effective_username, event_type, event_sub_type, action_file_name, action_file_path, action_file_extension, action_file_sha256

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution".

Thank you.

Re: Unable to retrive downloaded exe's

Malayamarutham — Wed, 15 Jan 2025 17:48:33 GMT

Thank a ton for that. That really helped in retrieving the all EXE files downloaded via internet, likely through firewall and filtered or monitored by Zscaler. So, do I need to join paloalto traffic raw dataset to it? It's a little confusing.

| join (

dataset= panw_ngfw_traffic_raw

| filter dest_port in (80,443) // Focus on web traffic (HTTP/HTTPS)

| filter ap[p in ("web-browsing", "ssl") // Application types for internet downloads

) on action_networks_session_id = session_id

I tried this but doesn't work. Truly appreciate your help.

Re: Unable to retrive downloaded exe's

aspatil — Wed, 29 Jan 2025 09:21:52 GMT

What exactly you are trying to achieve now? Can you please confirm?