Hi @cylusaragao, thanks for reaching us using the Live Community.
Yes, you can create a custom BIOC to monitor and block the MS Store access.
XQL Query:
dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name = "WinStore.App.exe" // Be sure this is the executable name
Save it as a BIOC rule from the XQL Query, change fields as needed:
Now add this BIOC Rule to a Restrictions Profile from the BIOCs menu, to block the execution.
Please let me know how it goes.
If this post answers your question, please mark it as the solution.
Hi @cylusaragao, thanks for reaching us using the Live Community.
Yes, you can create a custom BIOC to monitor and block the MS Store access.
XQL Query:
dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name = "WinStore.App.exe" // Be sure this is the executable name
Save it as a BIOC rule from the XQL Query, change fields as needed:
Now add this BIOC Rule to a Restrictions Profile from the BIOCs menu, to block the execution.
Please let me know how it goes.
If this post answers your question, please mark it as the solution.
