Cortex XDR don't alert when using WinPeas.bat

Good morning,
We have noticed that when using LinPEAS on Linux systems, Cortex XDR reacts, blocks and alerts. However, using WinPEAS bat script on Windows systems is not detected by Cortex. However winpeas.exe is blocked immediately. 

For testing purp

Sharing various xql queries

This returns dns queries filtered by the domain name given in the variable.

config case_sensitive = false
| preset = network_story
| filter (dns_resolutions != null)
| arrayexpand dns_resolutions
| alter Resolution_Value = dns_resolutions -> value{

Domain Controller can't connect to the Broker VM for Windows Event Collector

Hi All,

we are facing an Issue with the WEC on the Broker VM. We configured the Domain Controller and enabled the WEC on the Broker VM.

We followed the installation guide which is refered in the Cortex XDR. 

The Domain Controller shows in the log

How to change agent password

Hello,

How to change agent password in cortex XDR for few servers and endpoints not for all the agents.

Regards,

Shashank

How to Troubleshooting

Investigating detected alerts for alerts up in XDR.

I want to know reason detected using support files.

Would you please kindly how to getting detect a reason it.

Check IP reputation through IOC

Hi,

I need to create a XQL or something in Cortex XDR, where I get IP address from O365 logs and check if match with IOCs I have in Cortex XDR.

Could you help

Regards,

Fábio Ferreira

Cortex XDR protection against Double DLL Sideloading

Does Cortex XDR provide protection against the  Double DLL Sideloading to evade detection? 

https://www.bleepingcomputer.com/news/security/hackers-start-using-double-dll-sideloading-to-evade-detection/

7.9.100-CE version is it necessary to upgrade with CE version

Hi All, 

We have received an update regarding the 7.9.100 CE  hotfix for cortex xdr agent.

Can someone please let me know whether this update fixes the upgrade failure of windows 7 Operating system or upgrade failure of cortex xdr agent. Also, is i

XQL Query: Hunting for git related activity not related to Github

Good Day,

I am fairly new to Cortex but have been looking to detect git related activity not associated to Github. I believe I have a decent grasp on the volume as well as the observed destinations. I am running into issues differentiating what ini

Any guidance around regex for exceptions?

We are running into issues when we need to provide exceptions for command line for Child Process Protection, and it is a struggle even when it is supposed to be a simple wildcard use. 

Has anyone run into this issue or have tips on how to go about

User activity

Hello,

I used Cortex XDR for Endpoint Security, but I would like to know if XDR can identify and report user activity and time spent on it.

Thanks.