monitor command line on powershell or cmd with XQL

Bouzeghoub — Tue, 09 Sep 2025 12:51:31 GMT

Hi,

Please I want monitor any command line excute on powershell or cmd with XQL for example quser or systeminfo cli.

Thank you.

Re: monitor command line on powershell or cmd with XQL

eluis — Fri, 19 Sep 2025 13:51:16 GMT

Hi @Bouzeghoub

Let me give you a couple of examples that you can fine tune accordingly to your needs

Example 1:

dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name = "powershell.exe" and action_process_image_command_line contains "systeminfo"
| fields action_process_image_path, action_process_image_name, actor_process_image_md5, actor_process_image_name, actor_process_image_sha256, event_type, actor_process_command_line, action_process_image_command_line, causality_actor_process_image_md5, causality_actor_process_image_sha256, actor_process_signature_product, event_sub_type, actor_process_execution_time

Example 2:

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: monitor command line on powershell or cmd with XQL

Bouzeghoub — Thu, 25 Sep 2025 10:48:49 GMT

Hi @eluis

Thank you for your help,

I see juste old logs with one day.

Please do you have any idea and which GPO we need to enable?

Best regards.

topic Re: monitor command line on powershell or cmd with XQL in Cortex XDR Discussions

monitor command line on powershell or cmd with XQL

Re: monitor command line on powershell or cmd with XQL

Re: monitor command line on powershell or cmd with XQL