Malware detection

sathishkumar.c — Sat, 31 Oct 2026 11:27:44 GMT

Hi Team,

In our environment, a file was detected as malware. Based on the investigation, the file was downloaded using Firefox. We need to identify the exact source URL from which the file was downloaded.

We have already checked the Causality Chain for the file, but multiple URLs are displayed, making it difficult to determine the actual download source.

Could you please advise how to identify the exact download URL in Cortex XDR? Specifically:

Is there an XQL query that can correlate the downloaded file with the corresponding network connection?
Is there a recommended method to identify the exact URL when multiple URLs are present in the causality chain?

Thanks,

Sathishkumar C.

Re: Malware detection

ChrisDavila — Fri, 06 Nov 2026 14:30:32 GMT

Try the 'action_process_file_web_mark' field. You may need the extended threat hunting module to use this field.

Do you have sysmon logs? You can also check event code 15

Re: Malware detection

susekar — Fri, 06 Nov 2026 14:59:19 GMT

Hello @sathishkumar.c ,

Greetings for the day.

1. Correlating Downloaded Files with Network Connections Using XQL

Cortex XDR does not provide a predefined query to directly link a file-write event to its download URL.
File creation events and network connection events are recorded separately in the xdr_data dataset.
To correlate them, filter events using:
- Same endpoint name.
- Same browser process (e.g., firefox.exe).
- File name or file path.
- A narrow time window around the file creation timestamp.
Review network activity immediately before the file-write event to identify potential download sources.

Example Correlation Query:

You can run an XQL query to review both the file-write activity and the network connections made by Firefox around the alert timestamp:

dataset = xdr_data
| filter endpoint_name = "<ENDPOINT_NAME>" 
    and actor_process_image_name ~= "firefox"
    and (
        (event_type = ENUM.FILE and (action_file_name ~= "<MALWARE_FILE_NAME>" or action_file_path ~= "<MALWARE_FILE_NAME>"))
        or event_type = ENUM.NETWORK
    )
| fields _time, event_type, action_file_name, action_file_path, dst_action_external_hostname, action_url, dst_action_ip, dst_action_port
| sort desc _time

2. Identifying the Exact Download URL

A. Mark of the Web (MOTW)

Check the [www] or File Origin indicator in Causality View.
Review HostUrl (download source) and ReferrerUrl (referring webpage).

B. Timestamp Correlation

Identify the file creation timestamp.
Trace preceding browser network activity.
Exclude unrelated background connections.

C. Network Log Verification

Check NGFW or proxy logs.
Correlate endpoint IP and timestamp.
Review HTTP GET requests to confirm the URL.

Note: Use MOTW HostUrl for direct identification. If unavailable, correlate timestamps with network and proxy logs.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Re: Malware detection in Cortex XDR Discussions

Malware detection

Re: Malware detection

Re: Malware detection

1. Correlating Downloaded Files with Network Connections Using XQL

2. Identifying the Exact Download URL