topic Re: Detect user who moved a folder using XDR and XQL in Cortex XDR Discussions

Detect user who moved a folder using XDR and XQL

tlmarques — Thu, 03 Jul 2025 10:47:26 GMT

Hi everyone,

I need help identifying which user moved a specific folder from a network share to another location. The only information I currently have is:

The old folder path (e.g., \\server\share\oldfolder)
The new folder path (e.g., \\server\users\john\newfolder)
Access to endpoint data only — no file server logs or QRadar correlation available

Does anyone know if it's possible to detect this using XQL?

If so, what kind of query should I use to track file move or rename operations across these paths?

Thanks in advance for any guidance!

Re: Detect user who moved a folder using XDR and XQL

eluis — Thu, 03 Jul 2025 13:57:42 GMT

Ola Tiago,

Let me give you some hints:

With this query you can identigy all file movements that happened.

You will see fields like actor_effective_username , action_file_previous_file_path and action_file_path

preset = xdr_file
| filter (`event_sub_type` in (FILE_CREATE_NEW, FILE_REMOVE, FILE_RENAME, FILE_OPEN, FILE_WRITE))

Based on the event_sub_type and provided fields, try to identify the events which occurred after moving the file and create the correlation rule to detect it.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis