Alert when a XLL was created/read/deleted

[RFeyertag]

Hello dear community, 

what is the best way to setup a query for bioc to get an alert. Maybe correlation rule is a better place for my project?

It should alert, when a XLL File was written or read or deleted. 

Should I setup a specific file location in my query or is this not neccasary and I can take any file location? I ask because of the ressources on the client. 

BR

Rob

[bbarmanroy]

Hi @RFeyertag , certainly you can do that.

Try playing around with this query:
dataset = xdr_data
| filter agent_hostname = "bbarmanroyWinDemo"
|filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = ENUM.FILE_REMOVE or event_sub_type = ENUM.FILE_RENAME )
|filter action_file_extension in ("txt") and action_file_path in("C:\users\IEUser\Desktop\*","C:\BGinfo\*")