topic Need help - BIOC / Script / XQL? in Cortex XDR Discussions

Need help - BIOC / Script / XQL?

CraigV123 — Mon, 10 Feb 2025 16:12:58 GMT

Hey everyone. I need some assistance in looking at this logically.

We have an identified PuP in our environment that is persistent. It creates a scheduled task and if you don't remove that, your PuP that you deleted will be back in no time.

Is there a methodical and easy way to find that scheduled task (with the information we have, e.g., keywords, etc.) and disable or remove that scheduled task? A bonus would be to remove that and every other "tentacle" this PuP has on the system, but I'll settle with starting on the scheduled task. Not sure if I'm explaining it properly but I know XDR Pro can do it, somehow and someway, I just have the foggiest idea on where to start.

Thanks all!

Re: Need help - BIOC / Script / XQL?

jmazzeo — Mon, 10 Feb 2025 19:45:25 GMT

Hi @CraigV123, thanks for reaching us using the Live Community.

You can try a XQL Query to retrieve the scheduled tasks created with any command:

dataset = xdr_data | filter action_process_image_command_line contains "schtasks"

With some tuning, this XQL query can be also used as a BIOC rule.

You can also try using the Windows Event Logs:

dataset = xdr_data | filter event_type = ENUM.EVENT_LOG | filter action_evtlog_event_id = 4698 | fields action_evtlog_provider_name, action_evtlog_event_id, event_type, action_evtlog_message

Having the task names, you can create a script to run in the affected endpoints to remove the tasks. You can even also use scripts to get the scheduled tasks in the endpoints and if the name matches, remove it.

If this post answers your question, please mark it as the solution.

Re: Need help - BIOC / Script / XQL?

CraigV123 — Tue, 11 Feb 2025 15:41:23 GMT

I needed a logical way to break that down and you explained it how I needed. I appreciate it. Thanks again.