Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • HAFNIUM targeting Exchange Servers with 0-day exploits

    RaviSoni
    • Threat Hunting
    • Under Review on
    • 0 Comments
    This query will perform a scan to check the WebShall present in the machine, One of the IOC technique released by Microsoft. WITH HOST_IOC AS ( WITH IOC_LIST (IOC_Type, Indicator) AS ( VALUES ('filepath','C:\inetpub\wwwroot\aspnet_client\%.aspx...

  • RDP Enrichment with AbuseIPDB Data

    Kris Wayman
    • Events
    • Approved on
    • 0 Comments
    This is a great query to start enriching RDP telemetry from your environment. You will need to sign up for an account with AbuseIPDB ( https://www.abuseipdb.com/ ) and generate an API key to call in the query below. -- YOU NEED TO EDIT THIS AND ADD...

  • Threat Hunting - Powershell Script Blocks

    AndyM
    • Processes
    • Approved on
    • 0 Comments
    With the Sophos process journals you can see loads of information about the execution of processes as well as their command lines, but you cannot see the session data used directly in powershell, since it is running within the same process. Thankfully...

  • Threat Hunting - Discovery of Password Policies

    AndyM
    • Threat Hunting
    • Under Review on
    • 0 Comments
    A simple query to look for executions of net.exe that make use of the account switch. These are sometimes used by adversaries to discover the local and domain password policies that are in enforced. -- Account Discovery: Password Policies -- T1201 looking...

  • Threat Hunting - Account Discovery

    AndyM
    • Threat Hunting
    • Approved on
    • 0 Comments
    Here is a simple query that can be used to look for any executions of the net.exe command. These are often used by threat actors and malware alike to discover the username and group memberships of local as well as domain accounts. -- Account Discovery...

  • EDR Query to find all local admins (Windows)

    Jacob Jensen2
    • User
    • Under Review on
    • 18 Comments
    I am searching for a way to query the local Administrators security group on every device in our environment. This seems like something Live Discover is capable of doing, but I haven't been able to figure out the OSQuery syntax to get it done. Right now...

  • Generic Search

    Karl_Ackerman
    • Anomalies
    • Approved on
    • 0 Comments
    One thing everyone wants is a generic search capability. Like what did that user run, or did process x run, or even do I have command lines with https references in them. (Someone clicked on a link) So a quick generic search is described below. Have...

  • MITRE ATT&CK EXFILTRATION Tactic IOC Detection

    Karl_Ackerman
    • ATT&CK
    • Approved on
    • 1 Comment
    Here is a query that looks at process and cmdlines to map to IOCs in the Exfiltration tactic for Mitre -- VARIABLE $$Start Search on Date and Time$$ DATE -- VARIABLE $$Total Hours to search$$ STRING -- Process cmdline IOC search, mapped to MITRE...

  • MITRE ATT&CK IMPACT Tactic IOC Detection

    Karl_Ackerman
    • ATT&CK
    • Approved on
    • 0 Comments
    Experimenting with a simple query to detect IOC's based on process/cmdline analysis. This one below maps the MITRE ATT&CK framework for IMPACT. -- VARIABLES -- Start Search on Date and Time Date -- Total Hours to search STRING -- Detect MITRE...

  • Detecting RED TEAM Activity

    Karl_Ackerman
    • Threat Hunting
    • Approved on
    • 1 Comment
    I suspect for most of us reading these posts, we have had the experience of a RedTeam test. This is where you as a business hire an outside party to perform a penetration test of your organization. They can use lots of different tactics from phishing...
Unfiltered HTML