Threat Hunting Scenerios

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Threat Hunting Scenerios

L0 Member

I would like to set the alert to detect the following scenerios

 

How can I config the XQL/Query in BIOC to detect: Cortex XDR 

  1. Login of local admin user (user with local administrators privilege)
  2. Stop of a windows service e.g “abc.exe” while the endpoint can still be ping or alive
  3. Change the status of Cortex Agent, e.g. from protected to unprotected

 

 

1 REPLY 1

L4 Transporter

Hello @Kelvin_Ng 

 

Thanks for reaching out on LiveCommunity!

Apologies for delayed response. Below are the answers to your queries.

1. In order to identify the user as administrator we need the AD group information. We can build query to look for login events (e.g. Event id. 4624) and then correlate these events with group information to find out whether the user was an admin on not. If you are using Cloud Identity Engine then you can use pan_dss_raw  dataset to query AD data.

Reference- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Set-Up-Clou...

2. Window has different event IDs for various services start and stop status. I have used the 5025 event id for window firewall service being stopped and built below query which also checks the status of endpoint. You can modify below query according to your use case.

dataset = xdr_data
| filter action_evtlog_event_id = 5025 //Event id for firewall service being stopped.
| join (dataset=endpoints | filter endpoint_status = CONNECTED | fields endpoint_status , endpoint_name , operational_status ) as ep ep.endpoint_name = agent_hostname
| fields action_evtlog_event_id , action_evtlog_message , endpoint_name , operational_status , endpoint_status

 

3. Regarding endpoint status change, I have built below query which check for endpoint status being changed from Protected.

dataset=endpoints
| filter (operational_status != PROTECTED)
| fields endpoint_name , operational_status , endpoint_status , operating_system

 

I hope these queries will help you to create your own based on use case. Please click Accept as Solution to acknowledge that the answer to your question has been provided.

  • 297 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!