Detect user who moved a folder using XDR and XQL

[tlmarques]

Hi everyone,

I need help identifying which user moved a specific folder from a network share to another location. The only information I currently have is:

• The old folder path (e.g., \\server\share\oldfolder)
• The new folder path (e.g., \\server\users\john\newfolder)
• Access to Cortex XDR endpoint data only — no file server logs or QRadar correlation available

Does anyone know if it's possible to detect this using XQL?

If so, what kind of query should I use to track file move or rename operations across these paths?

Thanks in advance for any guidance!

[eluis]

Ola Tiago, 

Let me give you some hints: 

With this query you can identigy all file movements that happened. 

You will see fields like actor_effective_username , action_file_previous_file_path and action_file_path 

preset = xdr_file
| filter (`event_sub_type` in (FILE_CREATE_NEW, FILE_REMOVE, FILE_RENAME, FILE_OPEN, FILE_WRITE))

Based on the event_sub_type and provided fields, try to identify the events which occurred after moving the file and create the correlation rule to detect it.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis