BIOC Rule - CGO V/S Actor_process_image_name

[meanmach]

Hi 

I wanted to understand, if i want to see certain cmdline activities from "x" Process.

Want to know what will be more efficient putting the "x" process in "Causality_actor_process_image_name"

or in "actor_process_image" while creating a BIOC

[jmazzeo]

Hi @meanmach, thanks for reaching us using the Live Community.

If you want to monitor the activity of the "X" process, when "X" is the process calling a cmdline for command execution, the right field is "causality_actor_process_image_name". The "causalty" prefix indicates the parent process in the execution chain, and should work in this case.

You can find some interesting information about all the xdr_data dataset fields here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/XDR_DATA-Fields-by-Acto...

If this post answers your question, please mark it as the solution.

[meanmach]

Thanks a lot for the information however i want to understand if i use the actor_process_image_name field is that logic wrong?  as in BIOC rule given by Palo Alto to detect recon Activity via Web shell they have used "actor_process_image_name" = "w3wp.exe"