topic Re: Query to see user that launched an EXE and how many times in Cortex XDR Discussions

Query to see user that launched an EXE and how many times

J.Suter — Wed, 14 May 2025 16:42:37 GMT

I've been trying so many different queries and cant seem to make one that shows me what users launched an EXE and when or how many times as a count.

As an example to make it easy:

Search for everyone that executed winword.exe and show me when they did it.

Or search of everyone that executed winword.exe and count of times in X range

If anyone has a query and could share it that would be so helpful, I'm having a hard time getting my schema to work.

Thank you so much!

Edit: I have this working, but I'm not stuck on how to make a count: the "winword.exe" will become $Application for my user base.

dataset = xdr_data | filter action_process_image_name = "winword.exe" | fields agent_hostname , actor_effective_username , action_process_image_name , action_process_image_path | sort desc _time

Got it, leaving this here for anyone else that may need this information:

dataset = xdr_data | filter action_process_image_name = "winword.exe" | fields agent_hostname , actor_effective_username , action_process_image_name , action_process_image_path | comp count(actor_effective_username) as counter by actor_effective_username | sort desc Counter

Re: Query to see user that launched an EXE and how many times

mbasutkar — Thu, 15 May 2025 15:12:23 GMT

Hi,

You can use the below XQL query to search the file executions

config timeframe = 7d
|dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name = "chrome.exe"
| fields _time, agent_hostname, actor_effective_username, actor_process_image_name, actor_process_image_path, actor_process_image_md5, actor_process_file_create_time, actor_process_execution_time, actor_process_signature_product, actor_process_file_internal_name
| sort desc _time

Please accept this solution if this resolves your query.

Regards,

Manjunath Basutkar

Re: Query to see user that launched an EXE and how many times

J.Suter — Tue, 27 May 2025 17:04:30 GMT

Issue was solved in the initial post, found the proper schema to use to find all the data needed, see main comment: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/query-to-see-user-that-launched-an-exe-and-how-many-times/m-p/1229076/highlight/true#M8308