topic Re: One BIOC with OR for Process name and CMD in Cortex XDR Discussions

One BIOC with OR for Process name and CMD

Bouzeghoub — Thu, 01 Jan 2026 08:33:51 GMT

Hi,

Please have you solution when we want to create one BIOC with two deferent process name or CMD.

EX: NAME: powershell.exe or CMD: ping

or we must split to two BIOC.

Best regards.

ssingh32 — Tue, 06 Jan 2026 11:58:40 GMT

Hi,

Please refer the below image.Yes,we can add two or more process by adding pipe.

Please mark the solution as accepted ,if it helps.

Bouzeghoub — Thu, 08 Jan 2026 09:00:46 GMT

Thank you @ssingh32, but this BIOC is:

powershell.exe or cmd.exe or certutil.exe AND ping * or netstat *

Please I want powershell.exe or cmd.exe or certutil.exe OR ping * or netstat *

ChrisDavila — Fri, 09 Jan 2026 13:01:23 GMT

Fair warning. This BIOC may generate a significant number of alerts.

I recommend using using XQL to create the BIOC.

Bouzeghoub — Fri, 09 Jan 2026 20:30:22 GMT

I know via XQL, I asked if there is a solution via UI.