BIOC rule

[Anirudha_Jadhav]

How to make BIOC rule in cortex xdr if an attacker tries to upload data to aws from PowerShell CLI? Cortex XDR 

[nsinghvirk · Accepted solution]

Hello @Anirudha_Jadhav 

Thanks for reaching out on LiveCommunity!

You can use the Network entity within query builder which provides you with pre build format in order to search network activity by IP address, port, host name, protocol, and more. In addition to network activity you can add acting process where you can define the Powershell parameters like command line, path, SHA256 etc in order to capture powershell details.

Apart from it you can take help from query library by searching for "upload" keyword. There are several prebuilt queries to detect data upload. You can take reference from them and build you own.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[nsinghvirk]

Hello @Anirudha_Jadhav 

Please share the XQL query of the BIOC rule. You can get it by going to BIOC rule and then right click to Open in XQL.