topic action_process_image_command_line Filter Issue in Cortex XDR Discussions

action_process_image_command_line Filter Issue

a2123k1 — Thu, 12 Jun 2025 16:10:04 GMT

Hi, I'm trying to build a query that would check for reg.exe launches. This is well and good, but the moment I add a filter action_process_image_command_line = "reg save" nothing appears, even though it was part of the initial result for reg.exe. When I checked the schema, action_process_image_command_line is a string, so I don't think my query was wrong. Is anyone else having the same issue?

config case_sensitive = false | dataset = xdr_data | filter agent_hostname = "hostname" | filter event_type = ENUM.PROCESS and event_sub_type in (ENUM.PROCESS_START, ENUM.PROCESS_STOP) and action_process_image_name = "reg.exe*" | filter action_process_image_command_line = "reg save" | fields agent_hostname, actor_effective_username, action_process_image_command_line, action_process_image_name, actor_process_command_line, *command_line*

Unfiltered
Unfiltered

Filtered

Re: action_process_image_command_line Filter Issue

A.Elzedy — Thu, 12 Jun 2025 21:08:11 GMT

Hi @a2123k1 ,

Typically, action_process_image_command_line would include the full command, i.e "reg save HKLM\\HARDWARE \"C:\\Program Files\...."

I would recommend shifting to contains instead

| filter action_process_image_command_line contains "reg save"

or leverage regex to ensure it starts with reg save

| filter action_process_image_command_line ~= "(^reg save(.*)$)"

Re: action_process_image_command_line Filter Issue

a2123k1 — Fri, 13 Jun 2025 12:52:35 GMT

Thanks for the suggestion, those didn't work either.