Query to Search For Password Files in Cortex XDR Pro

[Carracido]

Hello community!

Do you know whether it´s possible in Cortext XDR Pro to build a query to Search For Password Files ?

Many thanks!

[zsolomon]

HI Carracido, 

The answer will be two parts since i am not sure which one you meant:

1. In XDR Pro you can use XQL to build queries, My advice will be to either use a specific name if there is one or search for files from a specific extension.

2. Since XDR does not look into files, there is no way to know if the file is password protected.

I hope this helps.

[PeteJacobCF]

simply searching for the word "password" in the file name has really worked well for us and it is also what most of our pentest engagements use.

[fmoixsante]

@PeteJacobCF, if the word password is not in the name, XDR/XQL will not be able to tell you that a file is not password protected.

[PeteJacobCF]

yes exactly. I was simply saying that we have had some good success finding our users "password" files... meaning txt or .doc files users use to store passwords and usernames in. I was not saying this would find password protected files... 

[tech_noob]

This one will find password on command line argument, you will be surprised if you find a clear text password on this query

dataset = xdr_data
| filter actor_process_command_line = "*pass*"