topic Force XDR Agent in Cortex XDR Discussions

Force XDR Agent

Bouzeghoub — Wed, 10 Dec 2025 09:24:35 GMT

Hello,

Please, how to force XDR Agent to capture all commands on CMD and PowerShell without GPO?

For example, we can detect quser command, but we can't detect Set-Alias command.

The problem is another vendor can detect any command line running in memory.

Best regards.

Re: Force XDR Agent

ChrisDavila — Wed, 10 Dec 2025 21:27:43 GMT

dataset = xdr_data | filter (event_type = 31 and event_sub_type = 10) or (event_type = 15 and action_evtlog_event_id IN (4104)) | alter script_data = if (event_type = 15, action_evtlog_message , to_string(dynamic_event_string_map)) | fields agent_hostname, event_type, event_sub_type, actor_process_image_path, actor_process_os_pid, actor_process_image_md5, actor_process_signature_vendor, actor_process_signature_status, actor_effective_username, script_data

You need to find the data you are looking for. Use this xql query to narrow things down.

Re: Force XDR Agent

Bouzeghoub — Thu, 11 Dec 2025 07:00:32 GMT

Thank you so much for this xql query.

Best regards