PAN-SA-2024-0005 Informational Bulletin: Proof of Concept (PoC) Bypasses Protection Modules in Cortex XDR Agent
📋 Description
The Palo Alto Networks Product Security Assurance team is aware of research presented by SafeBreach entitled "The Dark Side of EDR", describing a specifically crafted proof of concept (PoC) that bypasses Cortex XDR agent endpoint protection modules. Practical attack scenarios require administrative privileges to perform this bypass. The technique presented is detected and blocked in agents with CU-1320 and later content updates. This issue does not represent a product vulnerability risk to customers using Cortex XDR agent. This issue is not applicable to Mac OS and Linux platforms.
🎯 Affected products1
- Cortex XDR Agent
✅ Remediation
Cortex XDR agent content update CU-1320 detects and prevents this technique. No updates are planned for Cortex XDR agent 5.0 as it does not have the relevant Behavioral Threat Protection module required to detect this technique.