topic Re: Query to Search For Password Files in Cortex XDR Pro in Cortex XDR Discussions

Query to Search For Password Files in Cortex XDR Pro

Carracido — Tue, 15 Jun 2021 15:19:59 GMT

Hello community!

Do you know whether it´s possible in Cortext XDR Pro to build a query to Search For Password Files ?

Many thanks!

Re: Query to Search For Password Files in Cortex XDR Pro

zsolomon — Wed, 16 Jun 2021 10:55:22 GMT

HI Carracido,

The answer will be two parts since i am not sure which one you meant:

1. In XDR Pro you can use XQL to build queries, My advice will be to either use a specific name if there is one or search for files from a specific extension.

2. Since XDR does not look into files, there is no way to know if the file is password protected.

I hope this helps.

Re: Query to Search For Password Files in Cortex XDR Pro

P.Jacob — Wed, 23 Jun 2021 13:38:10 GMT

simply searching for the word "password" in the file name has really worked well for us and it is also what most of our pentest engagements use.

Re: Query to Search For Password Files in Cortex XDR Pro

fmoixsante — Wed, 23 Jun 2021 16:55:10 GMT

@P.Jacob, if the word password is not in the name, XDR/XQL will not be able to tell you that a file is not password protected.

Re: Query to Search For Password Files in Cortex XDR Pro

P.Jacob — Thu, 24 Jun 2021 16:30:05 GMT

yes exactly. I was simply saying that we have had some good success finding our users "password" files... meaning txt or .doc files users use to store passwords and usernames in. I was not saying this would find password protected files...

Re: Query to Search For Password Files in Cortex XDR Pro

tech_noob — Mon, 19 Jul 2021 03:50:43 GMT

This one will find password on command line argument, you will be surprised if you find a clear text password on this query

dataset = xdr_data
| filter actor_process_command_line = "*pass*"