topic Capture the running command in memory in Cortex XDR Discussions

topic Capture the running command in memory in Cortex XDR Discussions https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/capture-the-running-command-in-memory/m-p/1243326#M8903 <P>Hello,</P> <P> </P> <P>Please, I want create XQL query or BIOC to show any running command in memory (fileless_scriptload_cmdline).</P> <P> </P> <P>Best regards.</P> Wed, 10 Dec 2025 08:20:37 GMT Bouzeghoub 2025-12-10T08:20:37Z Capture the running command in memory https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/capture-the-running-command-in-memory/m-p/1243326#M8903 <P>Hello,</P> <P> </P> <P>Please, I want create XQL query or BIOC to show any running command in memory (fileless_scriptload_cmdline).</P> <P> </P> <P>Best regards.</P> Wed, 10 Dec 2025 08:20:37 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/capture-the-running-command-in-memory/m-p/1243326#M8903 Bouzeghoub 2025-12-10T08:20:37Z Re: Capture the running command in memory https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/capture-the-running-command-in-memory/m-p/1243442#M8906 <P>I think Cortex XDR have a limitation for this point.</P> Tue, 09 Dec 2025 07:23:33 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/capture-the-running-command-in-memory/m-p/1243442#M8906 Bouzeghoub 2025-12-09T07:23:33Z