I want to block certain certutil commands from being executed through the BIOC Rule

P.Madye — Mon, 08 Sep 2025 14:48:46 GMT

Unable to get it why the below BIOC rule can't be added into the restrictions policy. I was trying to write a BIOC rule for monitoring dropped files via certutil. :

dataset = xdr_data

| filter event_type = 2 and event_sub_type = ENUM.NETWORK_STREAM_CONNECT

| filter actor_process_image_name = "certutil.exe"

| filter (

os_actor_process_command_line ~= ".*-urlcache.*" or

os_actor_process_command_line ~= ".*-decode.*" or

os_actor_process_command_line ~= ".*-encode.*" )

Re: I want to block certain certutil commands from being executed through the BIOC Rule

eluis — Mon, 15 Sep 2025 14:24:48 GMT

Hi @P.Madye

Restrictions Profile in Cortex XDR is not the same thing as a BIOC rule. So you cant always put a BIOC within a Restriction profile.

Restrictions Profile is a prevention feature that blocks execution of files, processes, scripts, or DLLs based on static conditions (e.g., file path, extension, process name, certificate).
Your query is a behavioral detection (network activity + process + command-line arguments). That’s dynamic behavior detection, not static blocking.
Because of this, Restrictions cannot “understand” filters like event_type, event_sub_type, or regex on command lines.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

topic Re: I want to block certain certutil commands from being executed through the BIOC Rule in Cortex XDR Discussions

I want to block certain certutil commands from being executed through the BIOC Rule

Re: I want to block certain certutil commands from being executed through the BIOC Rule