Create a BIOC that doesn't allow a specific folder to be created

[AmmarBahasan]

Hello,

i want to create a rule that prevent anyone from creating a directory with a specific name in C:\

for example: if we say the folder is named coffee, i don't want this folder directory being created "C:\Coffee" .

i tried to created it, but i couldn't find a way to do a BIOC for folder only for files.

thank you.

Cortex XDR

[bbarmanroy]

Here's a XQL query to get you alerts if a directory gets created

| dataset = xdr_data
| filter event_type = ENUM.FILE and (event_sub_type = ENUM.FILE_DIR_CREATE or event_sub_type = ENUM.FILE_DIR_RENAME)
| filter action_file_path in("C:\Coffee")

However, you might also want to look at additional controls like: why are users able to create directories in such paths and not under "C:\Users\<username>\", and how those permissions should be reviewed and applied to users.