Threat Hunting Scenerios

[Kelvin_Ng]

I would like to set the alert to detect the following scenerios

How can I config the XQL/Query in BIOC to detect: Cortex XDR 

1. Login of local admin user (user with local administrators privilege)
2. Stop of a windows service e.g “abc.exe” while the endpoint can still be ping or alive
3. Change the status of Cortex Agent, e.g. from protected to unprotected

[nsinghvirk]

Hello @Kelvin_Ng 

Thanks for reaching out on LiveCommunity!

Apologies for delayed response. Below are the answers to your queries.

1. In order to identify the user as administrator we need the AD group information. We can build query to look for login events (e.g. Event id. 4624) and then correlate these events with group information to find out whether the user was an admin on not. If you are using Cloud Identity Engine then you can use pan_dss_raw  dataset to query AD data.

Reference- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Set-Up-Clou...

2. Window has different event IDs for various services start and stop status. I have used the 5025 event id for window firewall service being stopped and built below query which also checks the status of endpoint. You can modify below query according to your use case.

dataset = xdr_data
| filter action_evtlog_event_id = 5025 //Event id for firewall service being stopped.
| join (dataset=endpoints | filter endpoint_status = CONNECTED | fields endpoint_status , endpoint_name , operational_status ) as ep ep.endpoint_name = agent_hostname
| fields action_evtlog_event_id , action_evtlog_message , endpoint_name , operational_status , endpoint_status

3. Regarding endpoint status change, I have built below query which check for endpoint status being changed from Protected.

dataset=endpoints
| filter (operational_status != PROTECTED)
| fields endpoint_name , operational_status , endpoint_status , operating_system

I hope these queries will help you to create your own based on use case. Please click Accept as Solution to acknowledge that the answer to your question has been provided.