Get specific word from files

[Bouzeghoub]

Hi,

Please, any idea to get specific word from files via BIOC or XQL?

For example: password, username....

BR.

[tlmarques]

I'm using this XQL, to see what users open files with "password" on Filename:

preset = xdr_file
| filter action_file_name contains "passwords" // To find file by file name
| fields agent_hostname, agent_ip_addresses , actor_effective_username , event_sub_type , action_file_name , action_file_path , actor_process_image_name , os_actor_process_command_line

| filter ((`action_file_name` contains """.txt""" or `action_file_name` contains """.xlsx""" or `action_file_name` contains """.one""" or `action_file_name` contains """.doc""") and (`action_file_name` not contains """.lnk""" and `action_file_name` not contains """.url""") and `action_file_path` not in ("""C:\\Users\\*\\AppData\\*""", """:Zone.Identifier"""))

[Bouzeghoub]

Thank you @tlmarques.

But the case is, for example we have text file on desktop and inside this file contain password, username....

Please, if you have any idea?

[tlmarques]

looking inside...i think not.

[Bouzeghoub]

I think this role for DLP?

Br.