OriginalFileName from VERSIONINFO in Cortex XDR Pro

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

OriginalFileName from VERSIONINFO in Cortex XDR Pro

L4 Transporter

Hey dear community, 

 

Threat actors often rename apps. Like a.exe instead of anydesk.exe. But they do not change the versioninfo. 

 

https://www.youtube.com/watch?v=oMAvSpq9fYY --> Minute 37

 

Is it possible to track this with cortex xdr pro?

 

BR

 

Rob

1 accepted solution

Accepted Solutions

L3 Networker

Hi,

 

I think you can use something like below to track/hunt for the use case in question:

 

config case_sensitive = false 
| dataset = xdr_data 
| filter event_type = ENUM.LOAD_IMAGE and event_sub_type = ENUM.LOAD_IMAGE_MODULE 
| alter File_Version = json_extract_scalar(action_module_file_info,"$.file_version")
| alter Product_Version = json_extract_scalar(action_module_file_info,"$.product_version")
| alter Company = json_extract_scalar(action_module_file_info,"$.company")
| alter Description = json_extract_scalar(action_module_file_info,"$.description")
| alter internal_name = json_extract_scalar(action_module_file_info,"$.internal_name")
| alter original_name = json_extract_scalar(action_module_file_info,"$.original_name")
| alter only_exe = arrayindex(regextract(action_module_path,"^.+\\(.*?)$"),0)
| filter only_exe contains ".exe"
| fields only_exe as Filename, internal_name, original_name, File_Version, Company, Product_Version, Description, actor_process_image_name as Process, action_module_path as Path
| limit 500

 

 

I have seen XDR in live where renaming instance of cmd.exe to something else and executing commands alerts in XDR.

Kind Regards
KS

View solution in original post

2 REPLIES 2

L3 Networker

Hi,

 

I think you can use something like below to track/hunt for the use case in question:

 

config case_sensitive = false 
| dataset = xdr_data 
| filter event_type = ENUM.LOAD_IMAGE and event_sub_type = ENUM.LOAD_IMAGE_MODULE 
| alter File_Version = json_extract_scalar(action_module_file_info,"$.file_version")
| alter Product_Version = json_extract_scalar(action_module_file_info,"$.product_version")
| alter Company = json_extract_scalar(action_module_file_info,"$.company")
| alter Description = json_extract_scalar(action_module_file_info,"$.description")
| alter internal_name = json_extract_scalar(action_module_file_info,"$.internal_name")
| alter original_name = json_extract_scalar(action_module_file_info,"$.original_name")
| alter only_exe = arrayindex(regextract(action_module_path,"^.+\\(.*?)$"),0)
| filter only_exe contains ".exe"
| fields only_exe as Filename, internal_name, original_name, File_Version, Company, Product_Version, Description, actor_process_image_name as Process, action_module_path as Path
| limit 500

 

 

I have seen XDR in live where renaming instance of cmd.exe to something else and executing commands alerts in XDR.

Kind Regards
KS

Thank you very much!

 

BR

 

Rob

  • 1 accepted solution
  • 1107 Views
  • 2 replies
  • 0 Likes
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!