bioc not prevent

[tlmarques]

Hi everyone,

i've created this bioc:

dataset = xdr_data | filter event_type = ENUM.LOAD_IMAGE | filter ACTOR_PROCESS_COMMAND_LINE contains "netsh" and ACTOR_PROCESS_COMMAND_LINE contains "advfirewall" and ACTOR_PROCESS_COMMAND_LINE contains "set" and ACTOR_PROCESS_COMMAND_LINE contains "currentprofile" and ACTOR_PROCESS_COMMAND_LINE contains "state" and ACTOR_PROCESS_COMMAND_LINE contains "off"

but the cortex not prevent this action, only detect ... how i can configure this for prevent??

[susekar]

Hello @tlmarques ,

Greetings for the day.

Standard Behavioral Indicator of Compromise (BIOC) rules in Cortex XDR are configured for Detection only by default. To enable prevention (blocking), you must convert the BIOC into a Custom Prevention Rule and apply it to an active Restrictions Profile.

The rule you created is currently failing to block because of incompatible XQL syntax and the selected event type. Follow these steps to configure it correctly for prevention:

1. Please Correct the XQL Syntax:

The Cortex XDR agent has specific requirements for prevention rules. The contains operator and simple string matching are often incompatible with agent-side enforcement.

• Use the Regex Operator: Replace contains with the regular expression operator ~= (tilde equals).
• Change the Event Type: Instead of ENUM.LOAD_IMAGE, use ENUM.PROCESS. This enables the agent to block the command at execution time rather than reacting to a module load.

Recommended Corrected Query:

dataset = xdr_data 
| filter event_type = ENUM.PROCESS 
| filter action_process_image_command_line ~= ".*netsh.*advfirewall.*set.*currentprofile.*state.*off.*"

2. Configure the Prevention Action

Once the BIOC rule is saved using compatible syntax, link it to a Restrictions Profile:

1. Navigate to Detection Rules → BIOC.
2. Locate your rule, right-click it, and select Add to restrictions profile.
   (If this option is missing, the XQL syntax is still incompatible with the agent’s prevention requirements.)
3. Select the Windows Restrictions Profile assigned to your target endpoints.
4. In the profile settings, ensure the rule is Enabled. The enforcement action for an enabled Custom Prevention Rule is automatically set to Block.
5. Save the profile and perform a manual check-in on the endpoint to force the policy update.

(Important Caveats here)

Asynchronous Nature:
Behavioral Threat Protection (BTP) is an asynchronous module. If the netsh process executes and terminates very quickly before the agent can intervene, the alert may appear as Detected even though the rule is configured to block.

Whitelisting:Some critical system processes are whitelisted from termination to maintain OS stability. If the command originates from a whitelisted process, process termination may be skipped.

Note - License Requirement: Creating and managing custom BIOC rules requires a Cortex XDR Pro license.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar