topic Re: XQL query for critical commands in Cortex XDR Discussions

XQL query for critical commands

R.Daz588554 — Wed, 12 Feb 2025 11:43:50 GMT

Hi everyone.
I'm trying to create an XQL query for a BIOC that will trigger an alert when specific commands are run.
I've tried the "visudo" and "sudo -l" commands on two servers. On one it detects both commands and on the other it only detects the "visudo" command.
The XQL query is as follows:

dataset = xdr_data
| filter event_type = ENUM.PROCESS and
event_sub_type = ENUM.PROCESS_START and
actor_process_command_line contains "visudo" or
actor_process_command_line contains "sudo -l"

Can you tell me if I'm choosing the correct fields for the query? Any idea how I can achieve my goal?

Re: XQL query for critical commands

jmazzeo — Wed, 12 Feb 2025 12:46:25 GMT

Hi @R.Daz588554, thanks for reaching us using the Live Community.

Are both servers the same distro? Maybe how the server runs the "sudo" command is different, try removing the event_type and event_sub_type filters.

Re: XQL query for critical commands

R.Daz588554 — Wed, 05 Mar 2025 15:04:01 GMT

The solution is to use:
actor_process_command_line in ("visudo*", "sudo -l*")

Thanks