topic Re: Get specific word from files in Cortex XDR Discussions

Get specific word from files

Bouzeghoub — Wed, 14 Jan 2026 10:51:11 GMT

Hi,

Please, any idea to get specific word from files via BIOC or XQL?

For example: password, username....

BR.

Re: Get specific word from files

tlmarques — Wed, 14 Jan 2026 12:08:40 GMT

I'm using this XQL, to see what users open files with "password" on Filename:

preset = xdr_file
| filter action_file_name contains "passwords" // To find file by file name
| fields agent_hostname, agent_ip_addresses , actor_effective_username , event_sub_type , action_file_name , action_file_path , actor_process_image_name , os_actor_process_command_line

| filter ((`action_file_name` contains """.txt""" or `action_file_name` contains """.xlsx""" or `action_file_name` contains """.one""" or `action_file_name` contains """.doc""") and (`action_file_name` not contains """.lnk""" and `action_file_name` not contains """.url""") and `action_file_path` not in ("""C:\\Users\\*\\AppData\\*""", """:Zone.Identifier"""))

Re: Get specific word from files

Bouzeghoub — Wed, 14 Jan 2026 12:28:59 GMT

Thank you @tlmarques.

But the case is, for example we have text file on desktop and inside this file contain password, username....

Please, if you have any idea?

Re: Get specific word from files

tlmarques — Wed, 14 Jan 2026 13:59:42 GMT

looking inside...i think not.

Re: Get specific word from files

Bouzeghoub — Thu, 15 Jan 2026 06:28:49 GMT

I think this role for DLP?

Br.