Force XDR Agent

[Bouzeghoub]

Hello,

Please, how to force XDR Agent to capture all commands on CMD and PowerShell without GPO?

For example, we can detect quser command, but we can't detect Set-Alias command.

The problem is another vendor can detect any command line running in memory.

Best regards.

[ChrisDavila]

dataset = xdr_data
| filter (event_type = 31 and event_sub_type = 10) or (event_type = 15 and action_evtlog_event_id IN (4104)) 
| alter script_data = if (event_type = 15, action_evtlog_message , to_string(dynamic_event_string_map))
| fields agent_hostname, 
    event_type, 
    event_sub_type, 
    actor_process_image_path, 
    actor_process_os_pid, 
    actor_process_image_md5, 
    actor_process_signature_vendor, 
    actor_process_signature_status, 
    actor_effective_username, 
    script_data

You need to find the data you are looking for. Use this xql query to narrow things down.