Is it possible to search for Macros in Cortex?

[Kamal.Kishore]

Can Cortex see if macros have been launched on an endpoint, specifically Office Macros? 

I tried the "All Actions" query and searched for .doc and .xls files but no luck. 

Has anyone tried to search for macros using Cortex query or xql? 

Just to clarify, I was trying to hunt for any macro executions seen on our endpoints whether they are malicious or not. 

[fmoixsante]

Hi @Kamal.Kishore 

If you know the hash value of macro part of the Excel file, yes. You can use Hash View to search for it, or Query Builder, or XQL queries.

[Kamal.Kishore]

Ya I wouldn't know the hash value, it would be a general search or audit looking for any Office Macros by their file properties. 

[fmoixsante]

Hi @Kamal.Kishore,

The XDR agent office protection ignores Excel files with no macros and will only report on those with a seemingly malicious macro. What you can do is look in XQL for all executed Excel files.

You could try something like this
dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and actor_process_image_name = "EXCEL.EXE"

[Kamal.Kishore]

Hi Fmoixsante,

Thank you for your response. 

That's a great query to identify where Excel.exe is running but I don't see any data pertaining to macro events. 

[jcandelaria]

Hi Kamal,

Try .xlsm instead.

[jcandelaria]

Hi Kamal,

Try .xlsm instead.

Thanks

[fmoixsante · Accepted solution]

The query I shared also gives all the files that Excel has opened. The query is just a basic query that you could use and modify as you like. 

For instance,

dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and actor_process_command_line contains "xlsm"

I would suggest you check our XQL documentation here and here.

I would also recommend you check our Cortex XDR Walkthrough videos. We have many videos showcasing every part of the Cortex XDR product.