topic Re: identify for MS Office processes that write an executable file with BIOC or XQL in Cortex XDR Discussions https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/identify-for-ms-office-processes-that-write-an-executable-file/m-p/1244960#M8951 <P>Hi,</P> <P>&nbsp;</P> <P>Yes, it is possible to create a BIOC rule from file events but it will be noisy and can led to a lot of alerts flood.</P> <P>&nbsp;</P> <P class="p1">Please mark the solution as accepted ,if it helps.</P> Tue, 06 Jan 2026 12:24:16 GMT ssingh32 2026-01-06T12:24:16Z identify for MS Office processes that write an executable file with BIOC or XQL https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/identify-for-ms-office-processes-that-write-an-executable-file/m-p/1244741#M8938 <P>Hi,</P> <P>Please, I want to identify for MS Office processes that write an executable file(s) with BIOC or XQL.</P> <P>Best regards.</P> Tue, 30 Dec 2025 12:23:14 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/identify-for-ms-office-processes-that-write-an-executable-file/m-p/1244741#M8938 Bouzeghoub 2025-12-30T12:23:14Z Re: identify for MS Office processes that write an executable file with BIOC or XQL https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/identify-for-ms-office-processes-that-write-an-executable-file/m-p/1244960#M8951 <P>Hi,</P> <P>&nbsp;</P> <P>Yes, it is possible to create a BIOC rule from file events but it will be noisy and can led to a lot of alerts flood.</P> <P>&nbsp;</P> <P class="p1">Please mark the solution as accepted ,if it helps.</P> Tue, 06 Jan 2026 12:24:16 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/identify-for-ms-office-processes-that-write-an-executable-file/m-p/1244960#M8951 ssingh32 2026-01-06T12:24:16Z