Cortex XDR XQL query to check which user is elevating access in linux

[tejaspatil12]

Hello Team , 

I am trying to write a XQL query to check which user is elevating access in Linux. 

can someone please help to write this query ?

Thanks in advance.

Cortex XDR  #XQL

[jmazzeo]

Hi @tejaspatil12, thanks for reaching us using the Live Community.

This is a simple example that can help you with your inquiry:

dataset = xdr_data
| filter agent_hostname = "HostName" // If you need to filter one endpoint
| filter actor_process_command_line contains "sudo"
| fields agent_hostname, agent_ip_addresses, actor_process_command_line // Add fields as needed

If this post answers your question, please mark it as the solution.

[tejaspatil12]

Thanks @jmazzeo  this is giving the list for all command lines. 

Can we add the field which user executed it ? so we can get the idea about which user elevated the access

[jmazzeo]

You can add any fields you need, look at the "field" stage line in the query and keep adding all the required fields.